13
13
3.0.23 affect all releases up to an including 3.0.25 and later. Samba 3.2.x was originaly cut from Samba
14
14
3.0.25 before 3.2.0-specific changes were applied. Unless a 3.0.x series feature is specifically revoked, the
15
15
behavior of the 3.2.x series can be expected to follow the earlier pattern.
16
</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2676275"></a>Upgrading from Samba-3.0.x to Samba-3.2.0</h3></div></div></div><p>
17
</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="oldupdatenotes"></a>Upgrading from Samba-2.x to Samba-3.0.25</h3></div></div></div><p>
18
<a class="indexterm" name="id2676298"></a>
19
<a class="indexterm" name="id2676304"></a>
20
<a class="indexterm" name="id2676311"></a>
16
</p><div class="sect2" title="Upgrading from Samba-3.0.x to Samba-3.2.0"><div class="titlepage"><div><div><h3 class="title"><a name="id2682336"></a>Upgrading from Samba-3.0.x to Samba-3.2.0</h3></div></div></div><p>
17
</p></div><div class="sect2" title="Upgrading from Samba-2.x to Samba-3.0.25"><div class="titlepage"><div><div><h3 class="title"><a name="oldupdatenotes"></a>Upgrading from Samba-2.x to Samba-3.0.25</h3></div></div></div><p>
18
<a class="indexterm" name="id2682359"></a>
19
<a class="indexterm" name="id2682366"></a>
20
<a class="indexterm" name="id2682373"></a>
21
21
This chapter deals exclusively with the differences between Samba-3.0.25 and Samba-2.2.8a.
22
22
It points out where configuration parameters have changed, and provides a simple guide for
23
23
the move from 2.2.x to 3.0.25.
24
</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2676324"></a>Quick Migration Guide</h3></div></div></div><p>
24
</p></div><div class="sect2" title="Quick Migration Guide"><div class="titlepage"><div><div><h3 class="title"><a name="id2682386"></a>Quick Migration Guide</h3></div></div></div><p>
25
25
Samba-3.0.25 default behavior should be approximately the same as Samba-2.2.x.
26
26
The default behavior when the new parameter <a class="link" href="smb.conf.5.html#PASSDBBACKEND" target="_top">passdb backend</a>
27
27
is not defined in the <code class="filename">smb.conf</code> file provides the same default behavior as Samba-2.2.x
28
28
with <a class="link" href="smb.conf.5.html#ENCRYPTPASSWORDS" target="_top">encrypt passwords = Yes</a> and
29
29
will use the <code class="filename">smbpasswd</code> database.
31
<a class="indexterm" name="id2676374"></a>
32
<a class="indexterm" name="id2676382"></a>
31
<a class="indexterm" name="id2682436"></a>
32
<a class="indexterm" name="id2682443"></a>
33
33
So why say that <span class="emphasis"><em>behavior should be approximately the same as Samba-2.2.x</em></span>? Because
34
34
Samba-3.0.25 can negotiate new protocols, such as support for native Unicode, that may result in
35
35
differing protocol code paths being taken. The new behavior under such circumstances is not
36
36
exactly the same as the old one. The good news is that the domain and machine SIDs will be
37
37
preserved across the upgrade.
39
<a class="indexterm" name="id2676402"></a>
40
<a class="indexterm" name="id2676409"></a>
41
<a class="indexterm" name="id2676416"></a>
42
<a class="indexterm" name="id2676422"></a>
39
<a class="indexterm" name="id2682464"></a>
40
<a class="indexterm" name="id2682470"></a>
41
<a class="indexterm" name="id2682477"></a>
42
<a class="indexterm" name="id2682484"></a>
43
43
If the Samba-2.2.x system is using an LDAP backend, and there is no time to update the LDAP
44
44
database, then make sure that <a class="link" href="smb.conf.5.html#PASSDBBACKEND" target="_top">passdb backend = ldapsam_compat</a>
45
45
is specified in the <code class="filename">smb.conf</code> file. For the rest, behavior should remain more or less the same.
46
46
At a later date, when there is time to implement a new Samba-3-compatible LDAP backend, it is possible
47
47
to migrate the old LDAP database to the new one through use of the <code class="literal">pdbedit</code>.
48
48
See <a class="link" href="passdb.html#pdbeditthing" title="The pdbedit Tool">The <span class="emphasis"><em>pdbedit</em></span> Command</a>.
49
</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2676475"></a>New Features in Samba-3.x Series</h2></div></div></div><p>
50
</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2676484"></a>New Features in Samba-3.2.x Series</h3></div></div></div><p>
51
</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2676494"></a>New Features in Samba-3.0.x</h3></div></div></div><p>
49
</p></div></div><div class="sect1" title="New Features in Samba-3.x Series"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2682537"></a>New Features in Samba-3.x Series</h2></div></div></div><p>
50
</p><div class="sect2" title="New Features in Samba-3.2.x Series"><div class="titlepage"><div><div><h3 class="title"><a name="id2682546"></a>New Features in Samba-3.2.x Series</h3></div></div></div><p>
51
</p></div><div class="sect2" title="New Features in Samba-3.0.x"><div class="titlepage"><div><div><h3 class="title"><a name="id2682556"></a>New Features in Samba-3.0.x</h3></div></div></div><p>
52
52
The major new features are:
53
</p><div class="orderedlist"><ol type="1"><li><p>
54
<a class="indexterm" name="id2676516"></a>
55
<a class="indexterm" name="id2676523"></a>
53
</p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>
54
<a class="indexterm" name="id2682578"></a>
55
<a class="indexterm" name="id2682584"></a>
56
56
Active Directory support. This release is able to join an ADS realm
57
57
as a member server and authenticate users using LDAP/Kerberos.
59
<a class="indexterm" name="id2676536"></a>
60
<a class="indexterm" name="id2676543"></a>
58
</p></li><li class="listitem"><p>
59
<a class="indexterm" name="id2682598"></a>
60
<a class="indexterm" name="id2682604"></a>
61
61
Unicode support. Samba will now negotiate Unicode on the wire, and
62
62
internally there is a much better infrastructure for multibyte
63
63
and Unicode character sets.
65
<a class="indexterm" name="id2676557"></a>
64
</p></li><li class="listitem"><p>
65
<a class="indexterm" name="id2682618"></a>
66
66
New authentication system. The internal authentication system has
67
67
been almost completely rewritten. Most of the changes are internal,
68
68
but the new authoring system is also very configurable.
70
<a class="indexterm" name="id2676572"></a>
69
</p></li><li class="listitem"><p>
70
<a class="indexterm" name="id2682632"></a>
71
71
New filename mangling system. The filename mangling system has been
72
72
completely rewritten. An internal database now stores mangling maps
75
<a class="indexterm" name="id2676585"></a>
76
New “<span class="quote">net</span>” command. A new “<span class="quote">net</span>” command has been added. It is
77
somewhat similar to the “<span class="quote">net</span>” command in Windows. Eventually, we
74
</p></li><li class="listitem"><p>
75
<a class="indexterm" name="id2682646"></a>
76
New <span class="quote">“<span class="quote">net</span>”</span> command. A new <span class="quote">“<span class="quote">net</span>”</span> command has been added. It is
77
somewhat similar to the <span class="quote">“<span class="quote">net</span>”</span> command in Windows. Eventually, we
78
78
plan to replace a bunch of other utilities (such as smbpasswd)
79
with subcommands in “<span class="quote">net</span>”.
81
<a class="indexterm" name="id2676613"></a>
79
with subcommands in <span class="quote">“<span class="quote">net</span>”</span>.
80
</p></li><li class="listitem"><p>
81
<a class="indexterm" name="id2682674"></a>
82
82
Samba now negotiates NT-style status32 codes on the wire. This
83
83
considerably improves error handling.
85
<a class="indexterm" name="id2676626"></a>
84
</p></li><li class="listitem"><p>
85
<a class="indexterm" name="id2682687"></a>
86
86
Better Windows 200x/XP printing support, including publishing
87
87
printer attributes in Active Directory.
89
<a class="indexterm" name="id2676640"></a>
90
<a class="indexterm" name="id2676646"></a>
91
<a class="indexterm" name="id2676653"></a>
88
</p></li><li class="listitem"><p>
89
<a class="indexterm" name="id2682700"></a>
90
<a class="indexterm" name="id2682707"></a>
91
<a class="indexterm" name="id2682714"></a>
92
92
New loadable RPC modules for passdb backends and character sets.
94
<a class="indexterm" name="id2676666"></a>
93
</p></li><li class="listitem"><p>
94
<a class="indexterm" name="id2682727"></a>
95
95
New default dual-daemon winbindd support for better performance.
97
<a class="indexterm" name="id2676678"></a>
98
<a class="indexterm" name="id2676684"></a>
99
<a class="indexterm" name="id2676691"></a>
96
</p></li><li class="listitem"><p>
97
<a class="indexterm" name="id2682739"></a>
98
<a class="indexterm" name="id2682746"></a>
99
<a class="indexterm" name="id2682753"></a>
100
100
Support for migrating from a Windows NT 4.0 domain to a Samba
101
101
domain and maintaining user, group, and domain SIDs.
103
<a class="indexterm" name="id2676704"></a>
104
<a class="indexterm" name="id2676711"></a>
102
</p></li><li class="listitem"><p>
103
<a class="indexterm" name="id2682766"></a>
104
<a class="indexterm" name="id2682773"></a>
105
105
Support for establishing trust relationships with Windows NT 4.0
106
106
domain controllers.
108
<a class="indexterm" name="id2676724"></a>
109
<a class="indexterm" name="id2676731"></a>
110
<a class="indexterm" name="id2676738"></a>
107
</p></li><li class="listitem"><p>
108
<a class="indexterm" name="id2682786"></a>
109
<a class="indexterm" name="id2682793"></a>
110
<a class="indexterm" name="id2682800"></a>
111
111
Initial support for a distributed Winbind architecture using
112
112
an LDAP directory for storing SID to UID/GID mappings.
113
</p></li><li class="listitem"><p>
114
114
Major updates to the Samba documentation tree.
116
<a class="indexterm" name="id2676756"></a>
117
<a class="indexterm" name="id2676763"></a>
115
</p></li><li class="listitem"><p>
116
<a class="indexterm" name="id2682818"></a>
117
<a class="indexterm" name="id2682825"></a>
118
118
Full support for client and server SMB signing to ensure
119
119
compatibility with default Windows 2003 security settings.
120
120
</p></li></ol></div><p>
121
121
Plus lots of other improvements!
122
</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2676778"></a>Configuration Parameter Changes</h4></div></div></div><p>
122
</p><div class="sect3" title="Configuration Parameter Changes"><div class="titlepage"><div><div><h4 class="title"><a name="id2682840"></a>Configuration Parameter Changes</h4></div></div></div><p>
123
123
This section contains a brief listing of changes to <code class="filename">smb.conf</code> options since the Samba-2.2.x series up to and
124
124
including Samba-3.0.25.
130
130
<span class="emphasis"><em>WHATSNEW.txt</em></span> that is part of the Samba distribution tarball. This file may also
131
131
be obtain on-line from the Samba <a class="ulink" href="http://www.samba.org/samba/" target="_top">web site</a>, in
132
132
the right column, under Current Stable Release, by clicking on <span class="emphasis"><em>Release Notes</em></span>.
133
</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2676823"></a>Removed Parameters</h4></div></div></div><a class="indexterm" name="id2676829"></a><p>
133
</p></div><div class="sect3" title="Removed Parameters"><div class="titlepage"><div><div><h4 class="title"><a name="id2682885"></a>Removed Parameters</h4></div></div></div><a class="indexterm" name="id2682890"></a><p>
134
134
In alphabetical order, these are the parameters eliminated from Samba-2.2.x through 3.0.25.
135
</p><div class="itemizedlist"><ul type="disc"><li><p>admin log</p></li><li><p>alternate permissions</p></li><li><p>character set</p></li><li><p>client codepage</p></li><li><p>code page directory</p></li><li><p>coding system</p></li><li><p>domain admin group</p></li><li><p>domain guest group</p></li><li><p>enable rid algorithm</p></li><li><p>enable svcctl</p></li><li><p>force unknown acl user</p></li><li><p>hosts equiv</p></li><li><p>ldap filter</p></li><li><p>min password length</p></li><li><p>nt smb support</p></li><li><p>post script</p></li><li><p>printer admin</p></li><li><p>printer driver</p></li><li><p>printer driver file</p></li><li><p>printer driver location</p></li><li><p>read size</p></li><li><p>source environment</p></li><li><p>status </p></li><li><p>strip dot </p></li><li><p>total print jobs</p></li><li><p>unicode</p></li><li><p>use rhosts</p></li><li><p>valid chars</p></li><li><p>vfs options</p></li><li><p>winbind enable local accounts</p></li><li><p>winbind max idle children</p></li><li><p>wins partners</p></li></ul></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2676994"></a>New Parameters</h4></div></div></div><p>The following new parameters have been released up to and including Samba 3.0.25 (grouped by function:)</p><p>Remote Management</p><a class="indexterm" name="id2677008"></a><div class="itemizedlist"><ul type="disc"><li><p>abort shutdown script</p></li><li><p>shutdown script</p></li></ul></div><p>User and Group Account Management</p><div class="itemizedlist"><ul type="disc"><li><p>add group script</p></li><li><p>add machine script</p></li><li><p>add user to group script</p></li><li><p>algorithmic rid base</p></li><li><p>delete group script</p></li><li><p>delete user from group script</p></li><li><p>passdb backend</p></li><li><p>rename user script</p></li><li><p>set primary group script</p></li><li><p>username map script</p></li></ul></div><p>Authentication</p><div class="itemizedlist"><ul type="disc"><li><p>auth methods</p></li><li><p>ldap password sync</p></li><li><p>passdb expand explicit</p></li><li><p>realm</p></li></ul></div><p>Protocol Options</p><div class="itemizedlist"><ul type="disc"><li><p>add port command</p></li><li><p>afs token lifetime</p></li><li><p>client lanman auth</p></li><li><p>client NTLMv2 auth</p></li><li><p>client schannel</p></li><li><p>client signing</p></li><li><p>client use spnego</p></li><li><p>defer sharing violations</p></li><li><p>disable netbios</p></li><li><p>dmapi support</p></li><li><p>enable privileges</p></li><li><p>use kerberos keytab</p></li><li><p>log nt token command</p></li><li><p>ntlm auth</p></li><li><p>paranoid server security </p></li><li><p>sendfile</p></li><li><p>server schannel</p></li><li><p>server signing</p></li><li><p>smb ports</p></li><li><p>svcctl list</p></li><li><p>use spnego</p></li></ul></div><p>File Service</p><div class="itemizedlist"><ul type="disc"><li><p>allocation roundup size</p></li><li><p>acl check permissions</p></li><li><p>acl group control</p></li><li><p>acl map full control</p></li><li><p>aio read size</p></li><li><p>aio write size</p></li><li><p>dfree cache time</p></li><li><p>dfree command</p></li><li><p>ea support</p></li><li><p>enable asu support</p></li><li><p>fam change notify</p></li><li><p>force unknown acl user</p></li><li><p>get quota command</p></li><li><p>hide special files</p></li><li><p>hide unwriteable files</p></li><li><p>inherit owner</p></li><li><p>hostname lookups</p></li><li><p>kernel change notify</p></li><li><p>mangle prefix</p></li><li><p>map acl inherit</p></li><li><p>map read only</p></li><li><p>max stat cache size</p></li><li><p>msdfs proxy</p></li><li><p>open files database hash size</p></li><li><p>set quota command</p></li><li><p>store dos attributes</p></li><li><p>use sendfile</p></li><li><p>usershare allow guests</p></li><li><p>usershare max shares</p></li><li><p>usershare owner only</p></li><li><p>usershare path</p></li><li><p>usershare prefix allow list</p></li><li><p>usershare prefix deny list</p></li><li><p>usershare template share</p></li><li><p>vfs objects</p></li></ul></div><p>Printing</p><div class="itemizedlist"><ul type="disc"><li><p>cups options</p></li><li><p>cups server</p></li><li><p>force printername</p></li><li><p>iprint server</p></li><li><p>max reported print jobs</p></li><li><p>printcap cache time</p></li></ul></div><p>Unicode and Character Sets</p><div class="itemizedlist"><ul type="disc"><li><p>display charset</p></li><li><p>dos charset</p></li><li><p>UNIX charset</p></li></ul></div><p>SID to UID/GID Mappings</p><div class="itemizedlist"><ul type="disc"><li><p>idmap backend</p></li><li><p>idmap gid</p></li><li><p>idmap uid</p></li><li><p>username map script</p></li><li><p>winbind nss info</p></li><li><p>winbind offline logon</p></li><li><p>winbind refresh tickets</p></li><li><p>winbind trusted domains only</p></li><li><p>template primary group</p></li></ul></div><p>LDAP</p><div class="itemizedlist"><ul type="disc"><li><p>ldap delete dn</p></li><li><p>ldap group suffix</p></li><li><p>ldap idmap suffix</p></li><li><p>ldap machine suffix</p></li><li><p>ldap passwd sync</p></li><li><p>ldap replication sleep</p></li><li><p>ldap timeout</p></li><li><p>ldap user suffix</p></li></ul></div><p>General Configuration</p><div class="itemizedlist"><ul type="disc"><li><p>eventlog list</p></li><li><p>preload modules</p></li><li><p>reset on zero vc</p></li><li><p>privatedir</p></li></ul></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2677559"></a>Modified Parameters (Changes in Behavior)</h4></div></div></div><div class="itemizedlist"><ul type="disc"><li><p>acl group control (new default is No, deprecated parameter)</p></li><li><p>change notify timeout (scope changed)</p></li><li><p>dos filemode (disabled by default)</p></li><li><p>dos filetimes (enabled by default)</p></li><li><p>enable asu support (disabled by default)</p></li><li><p>enable privileges (enabled by default)</p></li><li><p>encrypt passwords (enabled by default) </p></li><li><p>host msdfs (enabled by default)</p></li><li><p>mangling method (set to hash2 by default) </p></li><li><p>map to guest</p></li><li><p>only user (deprecated)</p></li><li><p>passwd chat</p></li><li><p>passwd program</p></li><li><p>password server</p></li><li><p>restrict anonymous (integer value)</p></li><li><p>security (new ads value)</p></li><li><p>strict locking (auto by default)</p></li><li><p>winbind cache time (increased to 5 minutes)</p></li><li><p>winbind enum groups (disabled by default)</p></li><li><p>winbind enum users (disabled by default)</p></li><li><p>winbind nested groups (enabled by default)</p></li><li><p>winbind uid (deprecated in favor of idmap uid)</p></li><li><p>winbind gid (deprecated in favor of idmap gid)</p></li><li><p>winbindd nss info</p></li><li><p>write cache (deprecated)</p></li></ul></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2677694"></a>New Functionality</h3></div></div></div><p>
136
<a class="indexterm" name="id2677702"></a>
135
</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>admin log</p></li><li class="listitem"><p>alternate permissions</p></li><li class="listitem"><p>character set</p></li><li class="listitem"><p>client codepage</p></li><li class="listitem"><p>code page directory</p></li><li class="listitem"><p>coding system</p></li><li class="listitem"><p>domain admin group</p></li><li class="listitem"><p>domain guest group</p></li><li class="listitem"><p>enable rid algorithm</p></li><li class="listitem"><p>enable svcctl</p></li><li class="listitem"><p>force unknown acl user</p></li><li class="listitem"><p>hosts equiv</p></li><li class="listitem"><p>ldap filter</p></li><li class="listitem"><p>min password length</p></li><li class="listitem"><p>nt smb support</p></li><li class="listitem"><p>post script</p></li><li class="listitem"><p>printer admin</p></li><li class="listitem"><p>printer driver</p></li><li class="listitem"><p>printer driver file</p></li><li class="listitem"><p>printer driver location</p></li><li class="listitem"><p>read size</p></li><li class="listitem"><p>source environment</p></li><li class="listitem"><p>status </p></li><li class="listitem"><p>strip dot </p></li><li class="listitem"><p>total print jobs</p></li><li class="listitem"><p>unicode</p></li><li class="listitem"><p>use rhosts</p></li><li class="listitem"><p>valid chars</p></li><li class="listitem"><p>vfs options</p></li><li class="listitem"><p>winbind enable local accounts</p></li><li class="listitem"><p>winbind max idle children</p></li><li class="listitem"><p>wins partners</p></li></ul></div></div><div class="sect3" title="New Parameters"><div class="titlepage"><div><div><h4 class="title"><a name="id2683055"></a>New Parameters</h4></div></div></div><p>The following new parameters have been released up to and including Samba 3.0.25 (grouped by function:)</p><p>Remote Management</p><a class="indexterm" name="id2683070"></a><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>abort shutdown script</p></li><li class="listitem"><p>shutdown script</p></li></ul></div><p>User and Group Account Management</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>add group script</p></li><li class="listitem"><p>add machine script</p></li><li class="listitem"><p>add user to group script</p></li><li class="listitem"><p>algorithmic rid base</p></li><li class="listitem"><p>delete group script</p></li><li class="listitem"><p>delete user from group script</p></li><li class="listitem"><p>passdb backend</p></li><li class="listitem"><p>rename user script</p></li><li class="listitem"><p>set primary group script</p></li><li class="listitem"><p>username map script</p></li></ul></div><p>Authentication</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>auth methods</p></li><li class="listitem"><p>ldap password sync</p></li><li class="listitem"><p>passdb expand explicit</p></li><li class="listitem"><p>realm</p></li></ul></div><p>Protocol Options</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>add port command</p></li><li class="listitem"><p>afs token lifetime</p></li><li class="listitem"><p>client lanman auth</p></li><li class="listitem"><p>client NTLMv2 auth</p></li><li class="listitem"><p>client schannel</p></li><li class="listitem"><p>client signing</p></li><li class="listitem"><p>client use spnego</p></li><li class="listitem"><p>defer sharing violations</p></li><li class="listitem"><p>disable netbios</p></li><li class="listitem"><p>dmapi support</p></li><li class="listitem"><p>enable privileges</p></li><li class="listitem"><p>use kerberos keytab</p></li><li class="listitem"><p>log nt token command</p></li><li class="listitem"><p>ntlm auth</p></li><li class="listitem"><p>paranoid server security </p></li><li class="listitem"><p>sendfile</p></li><li class="listitem"><p>server schannel</p></li><li class="listitem"><p>server signing</p></li><li class="listitem"><p>smb ports</p></li><li class="listitem"><p>svcctl list</p></li><li class="listitem"><p>use spnego</p></li></ul></div><p>File Service</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>allocation roundup size</p></li><li class="listitem"><p>acl check permissions</p></li><li class="listitem"><p>acl group control</p></li><li class="listitem"><p>acl map full control</p></li><li class="listitem"><p>aio read size</p></li><li class="listitem"><p>aio write size</p></li><li class="listitem"><p>dfree cache time</p></li><li class="listitem"><p>dfree command</p></li><li class="listitem"><p>ea support</p></li><li class="listitem"><p>enable asu support</p></li><li class="listitem"><p>fam change notify</p></li><li class="listitem"><p>force unknown acl user</p></li><li class="listitem"><p>get quota command</p></li><li class="listitem"><p>hide special files</p></li><li class="listitem"><p>hide unwriteable files</p></li><li class="listitem"><p>inherit owner</p></li><li class="listitem"><p>hostname lookups</p></li><li class="listitem"><p>kernel change notify</p></li><li class="listitem"><p>mangle prefix</p></li><li class="listitem"><p>map acl inherit</p></li><li class="listitem"><p>map read only</p></li><li class="listitem"><p>max stat cache size</p></li><li class="listitem"><p>msdfs proxy</p></li><li class="listitem"><p>open files database hash size</p></li><li class="listitem"><p>set quota command</p></li><li class="listitem"><p>store dos attributes</p></li><li class="listitem"><p>use sendfile</p></li><li class="listitem"><p>usershare allow guests</p></li><li class="listitem"><p>usershare max shares</p></li><li class="listitem"><p>usershare owner only</p></li><li class="listitem"><p>usershare path</p></li><li class="listitem"><p>usershare prefix allow list</p></li><li class="listitem"><p>usershare prefix deny list</p></li><li class="listitem"><p>usershare template share</p></li><li class="listitem"><p>vfs objects</p></li></ul></div><p>Printing</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>cups options</p></li><li class="listitem"><p>cups server</p></li><li class="listitem"><p>force printername</p></li><li class="listitem"><p>iprint server</p></li><li class="listitem"><p>max reported print jobs</p></li><li class="listitem"><p>printcap cache time</p></li></ul></div><p>Unicode and Character Sets</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>display charset</p></li><li class="listitem"><p>dos charset</p></li><li class="listitem"><p>UNIX charset</p></li></ul></div><p>SID to UID/GID Mappings</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>idmap backend</p></li><li class="listitem"><p>idmap gid</p></li><li class="listitem"><p>idmap uid</p></li><li class="listitem"><p>username map script</p></li><li class="listitem"><p>winbind nss info</p></li><li class="listitem"><p>winbind offline logon</p></li><li class="listitem"><p>winbind refresh tickets</p></li><li class="listitem"><p>winbind trusted domains only</p></li><li class="listitem"><p>template primary group</p></li></ul></div><p>LDAP</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>ldap delete dn</p></li><li class="listitem"><p>ldap group suffix</p></li><li class="listitem"><p>ldap idmap suffix</p></li><li class="listitem"><p>ldap machine suffix</p></li><li class="listitem"><p>ldap passwd sync</p></li><li class="listitem"><p>ldap replication sleep</p></li><li class="listitem"><p>ldap timeout</p></li><li class="listitem"><p>ldap user suffix</p></li></ul></div><p>General Configuration</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>eventlog list</p></li><li class="listitem"><p>preload modules</p></li><li class="listitem"><p>reset on zero vc</p></li><li class="listitem"><p>privatedir</p></li></ul></div></div><div class="sect3" title="Modified Parameters (Changes in Behavior)"><div class="titlepage"><div><div><h4 class="title"><a name="id2683621"></a>Modified Parameters (Changes in Behavior)</h4></div></div></div><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>acl group control (new default is No, deprecated parameter)</p></li><li class="listitem"><p>change notify timeout (scope changed)</p></li><li class="listitem"><p>dos filemode (disabled by default)</p></li><li class="listitem"><p>dos filetimes (enabled by default)</p></li><li class="listitem"><p>enable asu support (disabled by default)</p></li><li class="listitem"><p>enable privileges (enabled by default)</p></li><li class="listitem"><p>encrypt passwords (enabled by default) </p></li><li class="listitem"><p>host msdfs (enabled by default)</p></li><li class="listitem"><p>mangling method (set to hash2 by default) </p></li><li class="listitem"><p>map to guest</p></li><li class="listitem"><p>only user (deprecated)</p></li><li class="listitem"><p>passwd chat</p></li><li class="listitem"><p>passwd program</p></li><li class="listitem"><p>password server</p></li><li class="listitem"><p>restrict anonymous (integer value)</p></li><li class="listitem"><p>security (new ads value)</p></li><li class="listitem"><p>strict locking (auto by default)</p></li><li class="listitem"><p>winbind cache time (increased to 5 minutes)</p></li><li class="listitem"><p>winbind enum groups (disabled by default)</p></li><li class="listitem"><p>winbind enum users (disabled by default)</p></li><li class="listitem"><p>winbind nested groups (enabled by default)</p></li><li class="listitem"><p>winbind uid (deprecated in favor of idmap uid)</p></li><li class="listitem"><p>winbind gid (deprecated in favor of idmap gid)</p></li><li class="listitem"><p>winbindd nss info</p></li><li class="listitem"><p>write cache (deprecated)</p></li></ul></div></div></div><div class="sect2" title="New Functionality"><div class="titlepage"><div><div><h3 class="title"><a name="id2683756"></a>New Functionality</h3></div></div></div><p>
136
<a class="indexterm" name="id2683764"></a>
137
137
The major changes in behavior since that Samba-2.2.x series are documented in this section.
138
138
Please refer to the <code class="filename">WHATSNEW.txt</code> file that ships with every release of
139
139
Samba to obtain detailed information regarding the changes that have been made during the
140
140
life of the current Samba release.
141
</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2677721"></a>TDB Data Files</h4></div></div></div><a class="indexterm" name="id2677727"></a><p>
141
</p><div class="sect3" title="TDB Data Files"><div class="titlepage"><div><div><h4 class="title"><a name="id2683783"></a>TDB Data Files</h4></div></div></div><a class="indexterm" name="id2683788"></a><p>
142
142
Refer to <a class="link" href="install.html" title="Chapter�1.�How to Install and Test SAMBA">Installation, Chapter 1</a>, <a class="link" href="install.html#tdbdocs" title="TDB Database File Information">Chapter 1</a>
143
143
for information pertaining to the Samba-3 data files, their location and the information that must be
144
144
preserved across server migrations, updates and upgrades.
146
<a class="indexterm" name="id2677757"></a>
146
<a class="indexterm" name="id2683819"></a>
147
147
Please remember to back up your existing ${lock directory}/*tdb before upgrading to Samba-3. If necessary,
148
148
Samba will upgrade databases as they are opened. Downgrading from Samba-3 to 2.2, or reversion to an earlier
149
149
version of Samba-3 from a later release, is an unsupported path.
151
<a class="indexterm" name="id2677772"></a>
151
<a class="indexterm" name="id2683834"></a>
152
152
The old Samba-2.2.x tdb files are described in <a class="link" href="upgrading-to-3.0.html#oldtdbfiledesc" title="Table�35.1.�Samba-2.2.x TDB File Descriptions">the next table</a>.
153
153
</p><div class="table"><a name="oldtdbfiledesc"></a><p class="title"><b>Table�35.1.�Samba-2.2.x TDB File Descriptions</b></p><div class="table-contents"><table summary="Samba-2.2.x TDB File Descriptions" border="1"><colgroup><col align="left"><col align="justify"><col align="left"></colgroup><thead><tr><th align="left">Name</th><th align="justify">Description</th><th align="center">Backup?</th></tr></thead><tbody><tr><td align="left">account_policy</td><td align="justify">User policy settings</td><td align="left">yes</td></tr><tr><td align="left">brlock</td><td align="justify">Byte-range file locking information.</td><td align="left">no</td></tr><tr><td align="left">connections</td><td align="justify"><p>Client connection information</p></td><td align="left">no</td></tr><tr><td align="left">locking</td><td align="justify">Temporary file locking data.</td><td align="left">no</td></tr><tr><td align="left">messages</td><td align="justify"><p>Temporary storage of messages being processed by smbd.</p></td><td align="left">no</td></tr><tr><td align="left">ntdrivers</td><td align="justify"><p>Stores per-printer driver information.</p></td><td align="left">yes</td></tr><tr><td align="left">ntforms</td><td align="justify"><p>Stores per-printer forms information.</p></td><td align="left">yes</td></tr><tr><td align="left">ntprinters</td><td align="justify"><p>Stores the per-printer devmode configuration settings.</p></td><td align="left">yes</td></tr><tr><td align="left">printing/*.tdb</td><td align="justify"><p>Cached output from lpq command created on a per-print-service basis.</p></td><td align="left">no</td></tr><tr><td align="left">registry</td><td align="justify"><p>Read-only Samba registry skeleton that provides support for
154
exporting various database tables via the winreg RPCs.</p></td><td align="left">no</td></tr><tr><td align="left">sessionid</td><td align="justify"><p>Temporary cache for miscellaneous session information.</p></td><td align="left">no</td></tr><tr><td align="left">share_info</td><td align="justify">Share ACL settings.</td><td align="left">yes</td></tr><tr><td align="left">unexpected</td><td align="justify"><p>Packets received for which no process was listening.</p></td><td align="left">no</td></tr><tr><td align="left">winbindd_cache</td><td align="justify"><p>Cache of identity information received from an NT4 or an ADS domain.</p></td><td align="left">yes</td></tr><tr><td align="left">winbindd_idmap</td><td align="justify"><p>New ID map table from SIDS to UNIX UIDs/GIDs.</p></td><td align="left">yes</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2678073"></a>Changes in Behavior</h4></div></div></div><p>
154
exporting various database tables via the winreg RPCs.</p></td><td align="left">no</td></tr><tr><td align="left">sessionid</td><td align="justify"><p>Temporary cache for miscellaneous session information.</p></td><td align="left">no</td></tr><tr><td align="left">share_info</td><td align="justify">Share ACL settings.</td><td align="left">yes</td></tr><tr><td align="left">unexpected</td><td align="justify"><p>Packets received for which no process was listening.</p></td><td align="left">no</td></tr><tr><td align="left">winbindd_cache</td><td align="justify"><p>Cache of identity information received from an NT4 or an ADS domain.</p></td><td align="left">yes</td></tr><tr><td align="left">winbindd_idmap</td><td align="justify"><p>New ID map table from SIDS to UNIX UIDs/GIDs.</p></td><td align="left">yes</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect3" title="Changes in Behavior"><div class="titlepage"><div><div><h4 class="title"><a name="id2684135"></a>Changes in Behavior</h4></div></div></div><p>
155
155
The following issues are known changes in behavior between Samba-2.2 and
156
156
Samba-3 that may affect certain installations of Samba.
157
</p><div class="orderedlist"><ol type="1"><li><p>
158
<a class="indexterm" name="id2678094"></a>
159
<a class="indexterm" name="id2678101"></a>
160
<a class="indexterm" name="id2678108"></a>
157
</p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>
158
<a class="indexterm" name="id2684156"></a>
159
<a class="indexterm" name="id2684163"></a>
160
<a class="indexterm" name="id2684170"></a>
161
161
When operating as a member of a Windows domain, Samba-2.2 would map any users authenticated by the remote DC
162
to the “<span class="quote">guest account</span>” if a UID could not be obtained via the getpwnam() call. Samba-3 rejects
163
the connection with the error message “<span class="quote">NT_STATUS_LOGON_FAILURE.</span>” There is no current workaround
162
to the <span class="quote">“<span class="quote">guest account</span>”</span> if a UID could not be obtained via the getpwnam() call. Samba-3 rejects
163
the connection with the error message <span class="quote">“<span class="quote">NT_STATUS_LOGON_FAILURE.</span>”</span> There is no current workaround
164
164
to re-establish the Samba-2.2 behavior.
166
<a class="indexterm" name="id2678132"></a>
167
<a class="indexterm" name="id2678139"></a>
165
</p></li><li class="listitem"><p>
166
<a class="indexterm" name="id2684194"></a>
167
<a class="indexterm" name="id2684201"></a>
168
168
When adding machines to a Samba-2.2 controlled domain, the
169
“<span class="quote">add user script</span>” was used to create the UNIX identity of the
170
machine trust account. Samba-3 introduces a new “<span class="quote">add machine
171
script</span>” that must be specified for this purpose. Samba-3 will
172
not fall back to using the “<span class="quote">add user script</span>” in the absence of
173
an “<span class="quote">add machine script</span>”.
174
</p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2678169"></a>Passdb Backends and Authentication</h4></div></div></div><p>
169
<span class="quote">“<span class="quote">add user script</span>”</span> was used to create the UNIX identity of the
170
machine trust account. Samba-3 introduces a new <span class="quote">“<span class="quote">add machine
171
script</span>”</span> that must be specified for this purpose. Samba-3 will
172
not fall back to using the <span class="quote">“<span class="quote">add user script</span>”</span> in the absence of
173
an <span class="quote">“<span class="quote">add machine script</span>”</span>.
174
</p></li></ol></div></div><div class="sect3" title="Passdb Backends and Authentication"><div class="titlepage"><div><div><h4 class="title"><a name="id2684231"></a>Passdb Backends and Authentication</h4></div></div></div><p>
175
175
There have been a few new changes that Samba administrators should be
176
176
aware of when moving to Samba-3.
177
</p><div class="orderedlist"><ol type="1"><li><p>
178
<a class="indexterm" name="id2678190"></a>
177
</p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>
178
<a class="indexterm" name="id2684252"></a>
179
179
Encrypted passwords have been enabled by default in order to
180
180
interoperate better with out-of-the-box Windows client
181
181
installations. This does mean that either (a) a Samba account
182
must be created for each user, or (b) “<span class="quote">encrypt passwords = no</span>”
182
must be created for each user, or (b) <span class="quote">“<span class="quote">encrypt passwords = no</span>”</span>
183
183
must be explicitly defined in <code class="filename">smb.conf</code>.
185
<a class="indexterm" name="id2678216"></a>
186
<a class="indexterm" name="id2678222"></a>
187
<a class="indexterm" name="id2678229"></a>
184
</p></li><li class="listitem"><p>
185
<a class="indexterm" name="id2684277"></a>
186
<a class="indexterm" name="id2684284"></a>
187
<a class="indexterm" name="id2684291"></a>
188
188
Inclusion of new <a class="link" href="smb.conf.5.html#SECURITY" target="_top">security = ads</a> option for integration
189
189
with an Active Directory domain using the native Windows Kerberos 5 and LDAP protocols.
190
190
</p></li></ol></div><p>
191
<a class="indexterm" name="id2678255"></a>
191
<a class="indexterm" name="id2684317"></a>
192
192
Samba-3 also includes the possibility of setting up chains of authentication methods (<a class="link" href="smb.conf.5.html#AUTHMETHODS" target="_top">auth methods</a>) and account storage backends (<a class="link" href="smb.conf.5.html#PASSDBBACKEND" target="_top">passdb backend</a>). Please refer to
193
193
the <code class="filename">smb.conf</code> man page and <a class="link" href="passdb.html" title="Chapter�11.�Account Information Databases">Account Information Databases</a>, for
194
194
details. While both parameters assume sane default values, it is likely that you will need to understand what
195
195
the values actually mean in order to ensure Samba operates correctly.
197
<a class="indexterm" name="id2678306"></a>
198
<a class="indexterm" name="id2678313"></a>
199
<a class="indexterm" name="id2678320"></a>
197
<a class="indexterm" name="id2684368"></a>
198
<a class="indexterm" name="id2684374"></a>
199
<a class="indexterm" name="id2684381"></a>
200
200
Certain functions of the <code class="literal">smbpasswd</code> tool have been split between the
201
201
new <code class="literal">smbpasswd</code> utility, the <code class="literal">net</code> tool, and the new <code class="literal">pdbedit</code>
202
202
utility. See the respective man pages for details.
203
</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2678354"></a>LDAP</h4></div></div></div><p>
203
</p></div><div class="sect3" title="LDAP"><div class="titlepage"><div><div><h4 class="title"><a name="id2684415"></a>LDAP</h4></div></div></div><p>
204
204
This section outlines the new features effecting Samba/LDAP integration.
205
</p><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2678364"></a>New Schema</h5></div></div></div><p>
206
<a class="indexterm" name="id2678372"></a>
207
<a class="indexterm" name="id2678378"></a>
208
<a class="indexterm" name="id2678385"></a>
209
<a class="indexterm" name="id2678392"></a>
205
</p><div class="sect4" title="New Schema"><div class="titlepage"><div><div><h5 class="title"><a name="id2684426"></a>New Schema</h5></div></div></div><p>
206
<a class="indexterm" name="id2684433"></a>
207
<a class="indexterm" name="id2684440"></a>
208
<a class="indexterm" name="id2684447"></a>
209
<a class="indexterm" name="id2684454"></a>
210
210
A new object class (sambaSamAccount) has been introduced to replace
211
211
the old sambaAccount. This change aids in the renaming of attributes
212
212
to prevent clashes with attributes from other vendors. There is a
245
245
in the Samba-3 <code class="filename">samba.schema</code> file.
247
247
Other new object classes and their uses include:
248
</p><div class="itemizedlist"><ul type="disc"><li><p>
249
<a class="indexterm" name="id2678573"></a>
250
<a class="indexterm" name="id2678580"></a>
251
<a class="indexterm" name="id2678586"></a>
252
<a class="indexterm" name="id2678593"></a>
253
<a class="indexterm" name="id2678600"></a>
254
<a class="indexterm" name="id2678607"></a>
248
</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
249
<a class="indexterm" name="id2684634"></a>
250
<a class="indexterm" name="id2684641"></a>
251
<a class="indexterm" name="id2684648"></a>
252
<a class="indexterm" name="id2684655"></a>
253
<a class="indexterm" name="id2684662"></a>
254
<a class="indexterm" name="id2684668"></a>
255
255
<code class="literal">sambaDomain</code> domain information used to allocate RIDs
256
256
for users and groups as necessary. The attributes are added
257
in “<span class="quote">ldap suffix</span>” directory entry automatically if
258
an idmap UID/GID range has been set and the “<span class="quote">ldapsam</span>”
257
in <span class="quote">“<span class="quote">ldap suffix</span>”</span> directory entry automatically if
258
an idmap UID/GID range has been set and the <span class="quote">“<span class="quote">ldapsam</span>”</span>
259
259
passdb backend has been selected.
261
<a class="indexterm" name="id2678637"></a>
262
<a class="indexterm" name="id2678644"></a>
263
<a class="indexterm" name="id2678651"></a>
260
</p></li><li class="listitem"><p>
261
<a class="indexterm" name="id2684699"></a>
262
<a class="indexterm" name="id2684706"></a>
263
<a class="indexterm" name="id2684713"></a>
264
264
sambaGroupMapping an object representing the
265
265
relationship between a posixGroup and a Windows
266
group/SID. These entries are stored in the “<span class="quote">ldap
267
group suffix</span>” and managed by the “<span class="quote">net groupmap</span>” command.
269
<a class="indexterm" name="id2678676"></a>
270
<a class="indexterm" name="id2678683"></a>
271
<a class="indexterm" name="id2678690"></a>
272
<a class="indexterm" name="id2678696"></a>
273
<code class="literal">sambaUNIXIdPool</code> created in the “<span class="quote">ldap idmap suffix</span>” entry
274
automatically and contains the next available “<span class="quote">idmap UID</span>” and
275
“<span class="quote">idmap GID</span>”.
277
<a class="indexterm" name="id2678728"></a>
278
<a class="indexterm" name="id2678735"></a>
266
group/SID. These entries are stored in the <span class="quote">“<span class="quote">ldap
267
group suffix</span>”</span> and managed by the <span class="quote">“<span class="quote">net groupmap</span>”</span> command.
268
</p></li><li class="listitem"><p>
269
<a class="indexterm" name="id2684738"></a>
270
<a class="indexterm" name="id2684744"></a>
271
<a class="indexterm" name="id2684751"></a>
272
<a class="indexterm" name="id2684758"></a>
273
<code class="literal">sambaUNIXIdPool</code> created in the <span class="quote">“<span class="quote">ldap idmap suffix</span>”</span> entry
274
automatically and contains the next available <span class="quote">“<span class="quote">idmap UID</span>”</span> and
275
<span class="quote">“<span class="quote">idmap GID</span>”</span>.
276
</p></li><li class="listitem"><p>
277
<a class="indexterm" name="id2684790"></a>
278
<a class="indexterm" name="id2684797"></a>
279
279
<code class="literal">sambaIdmapEntry</code> object storing a mapping between a
280
280
SID and a UNIX UID/GID. These objects are created by the
281
281
idmap_ldap module as needed.
282
</p></li></ul></div></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2678757"></a>New Suffix for Searching</h5></div></div></div><p>
283
<a class="indexterm" name="id2678764"></a>
284
<a class="indexterm" name="id2678771"></a>
285
<a class="indexterm" name="id2678778"></a>
286
<a class="indexterm" name="id2678785"></a>
287
<a class="indexterm" name="id2678792"></a>
288
<a class="indexterm" name="id2678799"></a>
289
<a class="indexterm" name="id2678806"></a>
282
</p></li></ul></div></div><div class="sect4" title="New Suffix for Searching"><div class="titlepage"><div><div><h5 class="title"><a name="id2684818"></a>New Suffix for Searching</h5></div></div></div><p>
283
<a class="indexterm" name="id2684826"></a>
284
<a class="indexterm" name="id2684833"></a>
285
<a class="indexterm" name="id2684840"></a>
286
<a class="indexterm" name="id2684846"></a>
287
<a class="indexterm" name="id2684853"></a>
288
<a class="indexterm" name="id2684860"></a>
289
<a class="indexterm" name="id2684867"></a>
290
290
The following new <code class="filename">smb.conf</code> parameters have been added to aid in directing
291
291
certain LDAP queries when <em class="parameter"><code>passdb backend = ldapsam://...</code></em> has been
293
</p><div class="itemizedlist"><ul type="disc"><li><p>ldap suffix used to search for user and computer accounts.</p></li><li><p>ldap user suffix used to store user accounts.</p></li><li><p>ldap machine suffix used to store machine trust accounts.</p></li><li><p>ldap group suffix location of posixGroup/sambaGroupMapping entries.</p></li><li><p>ldap idmap suffix location of sambaIdmapEntry objects.</p></li></ul></div><p>
294
<a class="indexterm" name="id2678874"></a>
295
<a class="indexterm" name="id2678881"></a>
293
</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>ldap suffix used to search for user and computer accounts.</p></li><li class="listitem"><p>ldap user suffix used to store user accounts.</p></li><li class="listitem"><p>ldap machine suffix used to store machine trust accounts.</p></li><li class="listitem"><p>ldap group suffix location of posixGroup/sambaGroupMapping entries.</p></li><li class="listitem"><p>ldap idmap suffix location of sambaIdmapEntry objects.</p></li></ul></div><p>
294
<a class="indexterm" name="id2684936"></a>
295
<a class="indexterm" name="id2684942"></a>
296
296
If an <em class="parameter"><code>ldap suffix</code></em> is defined, it will be appended to all of the
297
297
remaining subsuffix parameters. In this case, the order of the suffix
298
298
listings in <code class="filename">smb.conf</code> is important. Always place the <em class="parameter"><code>ldap suffix</code></em> first
added
removed
docs/htmldocs/Samba3-HOWTO/upgrading-to-3.0.html
