RHEA-2007:0638 - Product Enhancement Advisory

Topic

New samba packages that fix several bugs and add several enhancements are
now available.

Description

Samba provides an open source implementation of the SMB/CIFS protocols
which allow PC-compatible machines to share files, printers, and
other information.

This Samba update provides enhancements in the winbindd component, such as
offline logins and support for multiple idmap back-ends. This update also
contains bug fixes that allow Vista clients to correctly connect to a Samba
server.

Bugs fixed in these updated packages include:

• When the Active Directory domain policy was set to not expire passwords,

pam_winbind authentication would fail.

• The cleanup of expired or invalid byte range locks on files did not

work properly.

The updated packages add the following enhancements:

• several fixes were implemented to enhance winbindd stability.
• significant improvements in the winbind off-line log in support.
• secure DDNS updates are now supported as part of the 'net ads join' process.
• the IdMap interface was rewritten to allow TTL-based caching and

per-domain back-ends.

• a new plug-in interface for the "winbind nss info" parameter was added.
• a new file change notification subsystem was added to use inotify on Linux.
• passing Windows security descriptors to a Virtual File System(VFS)

plug-in is now supported. This allows multiple Unix ACL implementations to
run simultaneously on the same server.

• read performance with Linux servers is now improved.
• man pages for IdMap and VFS plug-ins were added.
• offline caching of files with Windows XP and Windows Vista clients is now

supported.

For more detailed information, refer to the WHATSNEW file in the update.

All samba users should upgrade to these updated packages, which fix these bugs.
and add these enhancements.

Solution

Before applying this update, make sure that all previously-released errata
relevant to your system have been applied.

You will also need to be aware of a change in the implicit default value of
the "msdfs root" parameter.

All options in samba have a default value even if you don't explicitly
declare them with an entry in smb.conf

In the previous release (Samba 3.0.23c) if you did not declare it in
smb.conf, the implicit default was:

msdfs root = yes

However, Windows Vista clients have problems with storing profiles on
msdfs-enabled shares. Consequently, with this release (Samba 3.0.25b), if
you do not declare it in smb.conf, the implicit default is the reverse:

msdfs root = no

This may cause problems with Windows clients.

Because Windows clients aggressively cache information about DFS enabled
shares, make sure to take this in consideration when choosing the
appropriate solution.

To avoid problems after the upgrade, two solutions are available:

1. Restart all your clients after the samba upgrade. You may need to re-map
persistent shares as well.

2. Explicitly declare "msdfs root = yes" in your smb.conf file.

This update is available via Red Hat Network. Details on how to use the Red
Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 218774 - security=ads broken, update to 3.0.23d
• BZ - 238423 - smbd crash with force user option
• BZ - 238757 - Update to 3.0.25 or later.
• BZ - 241409 - [printers] in default smb.conf points to /usr/spool instead of /var/spool
• BZ - 242744 - Missing character bug in latest security patches
• BZ - 244820 - Wrong init script
• BZ - 247447 - ReadDirectoryChangesW not working on 3.0.23
• BZ - 247538 - smbcacls doesn't change ownership/group
• BZ - 247539 - Notification reply packet size too big

CVEs

(none)

References

(none)