RHBA-2015:0409 - Bug Fix Advisory

Topic

Updated samba packages that fix several bugs and add various enhancements are
now available for Red Hat Enterprise Linux 7.

Description

Samba is an open-source implementation of the Server Message Block (SMB)
protocol and the related Common Internet File System (CIFS) protocol, which
allow PC-compatible machines to share files, printers, and other information.

The samba packages have been upgraded to upstream version 4.1.12, which provides
a number of bug fixes and enhancements over the previous version. (BZ#1110820)

This update also fixes the following bugs:

• The "net ads keytab create" command did not look up Service Principal Names

(SPNs) in Active Directory (AD). When the user joined a Linux machine to AD
using the "net ads join" command and created a new SPN using the "setspn"
utility, only default keytabs were created. Now, all SPNs specified in AD are
present. (BZ#955562)

• Samba was unable to connect to AD when the server operated on both the IPv4

and IPv6 protocols and the client operated only on IPv6. With this update, Samba
can join Windows domain networks as intended. (BZ#1024788)

• The "-S" parameter, accepted by the "net ads leave" command, did not support

long NetBIOS names. Trying to leave a domain could fail if the specified name
was longer than 15 characters. Now, leaving a domain works as expected, even if
the name supplied by "-S" is longer than 15 characters. (BZ#1089940)

• Previously, the nmb service did not advertise that it can only run when the

host supports the IPv4 protocol. Now, when the user runs the "service nmb start"
command with IPv4 disabled, the system returns a proper error message informing
about the requirement. (BZ#1101210)

• With the SMB2 and SMB3 protocols, the filename_convert() function was not

called on the full path, the last component of the path was not normalized, and
listing of large directories did not work correctly. Now, large directories can
be listed properly. (BZ#1113064)

• Samba incorrectly used the O_TRUNC flag when using the open() system call to

access the contents of a file that was already opened by a different process,
removing the previous contents of the file. The O_TRUNC flag is no longer used
in the above scenario, and files are not corrupted. (BZ#1115060)

• The function used to authenticate the user did not provide all information

about the user. When the function was used with another call to authenticate the
user over a secure channel, the field for the path to the home directory was
empty. Now, the correct function is called, and all required fields are filled
out. (BZ#1117770)

• When a non-root user executed the smbstatus command, the locked files were

missing from the command output. Non-root users are now able to display the
locked files. (BZ#1171689)

• Winbind presented unmapped non-POSIX groups when the idmap_ad attribute was

configured against the Windows Server 2008 R2 AD. When a user belonged to a
group with no POSIX GID attribute assigned, these groups unmapped by AD were
displayed after running the "id" and "wbinfo -r" commands on the user. Now,
Winbind no longer displays the unmapped groups. (BZ#1127931)

This update also adds the following enhancements:

• This update enables Samba to use the Performance Co-Pilot (PCP). (BZ#717484)
• Accounts created on the AD side use the Advanced Encryption Standard (AES)

keys by default. (BZ#878351)

• This update adds an alternative implementation of the libwbclient library. To

install and choose a libwbclient implementation, use the "alternatives" utility.
(BZ#1162526)

• Red Hat Enterprise Linux 6 contains the pam_smbpass module for authentication.

This update adds pam_smbpass to Red Hat Enterprise Linux 7. Note that
pam_smbpass is expected to be removed in the future; it is recommended to switch
to the pam_winbind module. (BZ#1181319)

Users of samba are advised to upgrade to these updated packages, which fix these
bugs and add these enhancements. After installing this update, the smb service
will be restarted automatically.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64

Fixes

• BZ - 861366 - net ads join occasionally fails to update DNS in domains with several DCs
• BZ - 878351 - RFE: Use AES keys by default
• BZ - 955561 - 'net ads join' overwrites all servicePrincipleNames in AD
• BZ - 955562 - 'net ads keytab create' only creates default SPNs and doesn't check AD for precreated ones.
• BZ - 1024788 - samba has troubles join to active directory via IPv6
• BZ - 1072352 - samba-pidl package should be noarch.
• BZ - 1088924 - ACL masks incorrectly applied when setting ACLs
• BZ - 1089940 - net ads leave -S - -S parameter doesn't support long netbios names (windows 2000 and newst netbios names)
• BZ - 1101210 - Unable to start nmb when host is IPv6 only.
• BZ - 1110820 - Rebase samba to 4.1.8 or later 4.1.x version
• BZ - 1135723 - [Samba] Does not work 'force user' from a client machine Windows 8.1 x64.
• BZ - 1156391 - netbios name truncating doesn't work
• BZ - 1162526 - Use alternatives for libwbclient
• BZ - 1162552 - net join segmentation fault on pcc64 and s390x
• BZ - 1172089 - net join to samba domain fails
• BZ - 1177768 - crash in function kerberos_fetch_pac
• BZ - 1179787 - Authentication fails against pure Kerberos domains
• BZ - 1181319 - Missing pam_smbpass.so in Samba

CVEs

(none)

References

(none)