Software:Samba

From HandWiki
Short description: Free software re-implementation of the SMB networking protocol
Samba
Samba logo 2010.svg
Initial release1992; 32 years ago (1992)[1]
Written inC, Python
Operating systemMultiplatform
TypeNetwork file system
License2008: GPL-3.0-or-later[lower-alpha 1]
1993: GPL-2.0-or-later[lower-alpha 2]
1992: Proprietary[lower-alpha 3]
Websitewww.samba.org

Samba is a free software re-implementation of the SMB networking protocol, and was originally developed by Andrew Tridgell. Samba provides file and print services for various Microsoft Windows clients[4] and can integrate with a Microsoft Windows Server domain, either as a Domain Controller (DC) or as a domain member. As of version 4, it supports Active Directory and Microsoft Windows NT domains.

Samba runs on most Unix-like systems, such as Linux, Solaris, AIX and the BSD variants, including Apple macOS (Mac OS X 10.2 and greater) and macOS Server. Samba also runs on a number of other operating systems such as OpenVMS and IBM i. Samba is standard on nearly all distributions of Linux and is commonly included as a basic system service on other Unix-based operating systems as well. Samba is released under the terms of the GNU General Public License. The name Samba comes from SMB (Server Message Block), the name of the proprietary protocol used by the Microsoft Windows network file system.

Early history

With a focus on interoperability with Microsoft's LAN Manager, Tridgell released "netbios for unix", observer, version 1.5 in December 1993. This release was the first to include client-software as well as a server. Also, at this time GPL2 was chosen as license.[citation needed]

Midway through the 1.5-series, the name was changed to smbserver. However, Tridgell got a trademark notice from the company "Syntax", who sold a product named TotalNet Advanced Server and owned the trademark for "SMBserver". The name "Samba" was derived by running the Unix command grep through the system dictionary looking for words that contained the letters S, M, and B, in that order (i.e. grep -i '^s.*m.*b' /usr/share/dict/words).[5]

Versions 1.6, 1.7, 1.8, and 1.9 followed relatively quickly, with the latter being released in January 1995. Tridgell considers the adoption of CVS in May 1996 to mark the birth of the Samba Team, though there had been contributions from other people, especially Jeremy Allison, previously.[6]

Version 2.0.0 was released in January 1999, and version 2.2.0 in April 2001.

Version history

Version 3.0.0, released on 23 September 2003, was a major upgrade. Samba gained the ability to join Active Directory as a member, though not as a domain controller.[7] Subsequent point-releases to 3.0 have added minor new features. Currently, the latest release in this series is 3.0.37, released 1 October 2009, and shipped on a voluntary basis.[8] The 3.0.x series officially reached end-of-life on 5 August 2009.[8]

Version 3.1 was used only for development.

With version 3.2, the project decided to move to time-based releases. New major releases, such as 3.3, 3.4, etc. will appear every six months. New features will only be added when a major release is done, point-releases will be only for bug fixes.[9] Also, 3.2 marked a change of license from GPL2 to GPL3, with some parts released under LGPL3.[3] The main technical change in version 3.2 was to autogenerate much of the DCE/RPC-code that used to be handcrafted. Version 3.2.0 was released on 1 July 2008.[10] and its current release is 3.2.15 from 1 October 2009. The 3.2.x series officially reached end-of-life on 1 March 2010.[10]

Date Version Description
2003-09-23 3.0 Active Directory support[11]
2008-07-01 3.2 It will be updated on an as-needed basis for security issues only[12]
2009-01-27 3.3
2009-07-03 3.4 This was the first release to include both Samba 3 and Samba 4 source code.[13]
2010-03-01 3.5 This was the first release to include experimental support for SMB2.[14]
2011-08-09 3.6 This is the first branch which includes full support for SMB2.[15]
2012-12-11 4.0 It is a major rewrite that enables Samba to be an Active Directory domain controller, participating fully in a Windows Active Directory Domain. Its first technical preview (4.0.0TP1) was released in January 2006 after 3 years of development.[16][17]
2013-10-10 4.1 support for SMB3
2015-03-04 4.2 Btrfs based file compression, snapshots and winbind integration[18]
2015-09-08 4.3 New Logging features, SMB 3.1.1 support[19]
2016-03-22 4.4 Asynchronous flush requests[20]
2016-09-07 4.5 NTLM v1 disabled by default, Virtual List View, Various performance improvements
2017-03-07 4.6 Multi-process Netlogon support
2017-09-21 4.7 Samba AD with MIT Kerberos
2018-03-13 4.8 Apple Time Machine Support. Setups using 'domain' or 'ads' security modes now require 'winbindd' to be running.[21]
2018-09-13 4.9 Many changes[22]
2019-03-19 4.10
2019-09-17 4.11 SMB1 is disabled by default as a mitigation for the WannaCry vulnerability.
2020-03-03 4.12
2020-09-22 4.13 Samba 4.13 raises the minimum version of Python to 3.6.
2021-03-09 4.14 Major overhaul of VFS subsystem and more.[23]
2021-09-20 4.15 Many changes.[24]
2022-03-21 4.16 Many changes.[25]
2022-09-13 4.17 Many changes.[26]
2023-03-8 4.18 Many changes.[27]
2023-09-4 4.19 Many changes.[28]
2024-03 4.20 Many changes.
{{{2}}}

Security

Some versions of Samba 3.6.3 and lower suffer serious security issues which can allow anonymous users to gain root access to a system from an anonymous connection, through the exploitation of an error in Samba's remote procedure call.[29]

On 12 April 2016, Badlock,[30] a crucial security bug in Windows and Samba, was disclosed. Badlock for Samba is referenced by CVE|2016-2118 (SAMR and LSA man in the middle attacks possible).[31]

On 24 May 2017, it was announced that a remote code execution vulnerability had been found in Samba named EternalRed or SambaCry, affecting all versions since 3.5.0.[32] This vulnerability was assigned identifier CVE|2017-7494.[32][33]

On 14 September 2020, a proof-of-concept exploit for the netlogon vulnerability called Zerologon (CVE|2020-1472) for which a patch exists since August was published.[34] Some federal agencies using the software have been ordered to install the patch.[35]

Features

Samba allows file and print sharing between computers running Microsoft Windows and computers running Unix. It is an implementation of dozens of services and a dozen protocols, including:

  • NetBIOS over TCP/IP (NBT)
  • SMB (known as CIFS in some versions)
    • Samba supports POSIX extensions for CIFS/SMB. The initial extension was CIFS VFS (CAP_UNIX) from 2004, which has been somewhat superseded by SMB3.[36]
  • DCE/RPC or more specifically, MSRPC, the Network Neighborhood suite of protocols
  • A WINS server also known as a NetBIOS Name Server (NBNS)
  • The NT Domain suite of protocols which includes NT Domain Logons
  • Security Account Manager (SAM) database
  • Local Security Authority (LSA) service
  • NT-style printing service (SPOOLSS)
  • NTLM
  • Active Directory Logon using modified versions of Kerberos and LDAP
  • DFS server

All these services and protocols are frequently incorrectly referred to as just NetBIOS or SMB. The NBT (NetBIOS over TCP/IP) and WINS protocols, and their underlying SMB version 1 protocol, are deprecated on Windows. Since Windows Vista the WS-Discovery protocol has been included along with SMB2 and its successors, which supersede these. (WS-Discovery is implemented on Unix-like platforms by third party daemons which allow Samba shares to be discovered when the deprecated protocols are disabled).

Samba sets up network shares for chosen Unix directories (including all contained subdirectories). These appear to Microsoft Windows users as normal Windows folders accessible via the network. Unix users can either mount the shares directly as part of their file structure using the mount.cifs command or, alternatively, can use a utility, smbclient (libsmb) installed with Samba to read the shares with a similar interface to a standard command line FTP program. Each directory can have different access privileges overlaid on top of the normal Unix file protections. For example: home directories would have read/write access for all known users, allowing each to access their own files. However they would still not have access to the files of others unless that permission would normally exist. Note that the netlogon share, typically distributed as a read only share from /etc/samba/netlogon, is the logon directory for user logon scripts.

Samba services are implemented as two daemons:

  • smbd, which provides the file and printer sharing services, and
  • nmbd, which provides the NetBIOS-to-IP-address name service. NetBIOS over TCP/IP requires some method for mapping NetBIOS computer names to the IP addresses of a TCP/IP network.

Samba configuration is achieved by editing a single file (typically installed as /etc/smb.conf or /etc/samba/smb.conf). Samba can also provide user logon scripts and group policy implementation through poledit.

Samba is included in most Linux distributions and is started during the boot process. On Red Hat, for instance, the /etc/rc.d/init.d/smb script runs at boot time, and starts both daemons. Samba is not included in Solaris 8, but a Solaris 8-compatible version is available from the Samba website. The OS/2-based ArcaOS includes Samba to replace the old IBM LAN Server software.[37]

Samba includes a web administration tool called Samba Web Administration Tool (SWAT).[38][39] SWAT was removed starting with version 4.1.[40]

Samba TNG

Samba TNG (The Next Generation) was forked in late 1999, after disagreements between the Samba Team leaders and Luke Leighton about the directions of the Samba project. They failed to come to an agreement on a development transition path which allowed the research version of Samba he was developing (known at the time as Samba-NTDOM) to slowly be integrated into Samba.[41] Development has been minimal, due to a lack of developers. The Samba TNG team frequently directed potential users towards Samba because of its better support and development.[42]

A key goal of the Samba TNG project was to rewrite all of the NT Domains services as FreeDCE projects.[43] This was made difficult as the services were developed manually through network reverse-engineering, with limited or no reference to DCE/RPC documentation.[citation needed]

A key difference from Samba was in the implementation of the NT Domains suite of protocols and MSRPC services. Samba makes all the NT Domains services available from a single place, whereas Samba TNG separated each service into its own program.[citation needed]

ReactOS started using Samba TNG services for its SMB implementation. The developers of both projects were interested in seeing the Samba TNG design used to help get ReactOS talking to Windows networks. They worked together to adapt the network code and build system. The multi-layered and modular approach made it easy to port each service to ReactOS.[44]

See also

Notes

  1. GPL-3.0-or-later and LGPL-3.0-or-later since 2008-07-01, version 3.2.0.[2][3]
  2. GPL-2.0-or-later from 1993, version 1.5, until 2009-10-01, version 3.0.37.
  3. Proprietary from 1992 until 1993.

References

  1. "Samba Latest News". https://www.samba.org/samba/latest_news.html. 
  2. "Samba Copyright Policy". https://www.samba.org/samba/devel/copyright-policy.html. 
  3. 3.0 3.1 "Samba Adopts GPLv3 for Future Releases". https://lists.samba.org/archive/samba-announce/2007/000122.html. 
  4. "Samba - opening windows to a wider world". https://www.samba.org/. 
  5. Andrew Tridgell and the Samba Team (27 June 1997). "A bit of history and a bit of fun". Archived on 15 August 2020. Error: If you specify |archivedate=, you must also specify |archiveurl=. http://www.rxn.com/services/faq/smb/samba.history.txt. 
  6. "10 years of Samba!". https://samba.org/samba/docs/10years.html. 
  7. "The first stable release of Samba 3.0 is available". https://lists.samba.org/archive/samba-announce/2003/000021.html. 
  8. 8.0 8.1 "Release Planning for Samba 3.0". https://wiki.samba.org/index.php/Release_Planning_for_Samba_3.0. 
  9. "Monday, April 28 - Samba Mashup Report". https://lists.samba.org/archive/samba-announce/2008/000136.html. 
  10. 10.0 10.1 "Release Planning for Samba 3.2". https://wiki.samba.org/index.php/Release_Planning_for_Samba_3.2. 
  11. "Samba Team announces the first official release of Samba 3.0". https://www.samba.org/samba/history/samba-3.0.0.html. 
  12. "[ANNOUNCE Samba 3.2.0 Available for Download"]. https://lists.samba.org/archive/samba-announce/2008/000145.html. 
  13. "Samba - Release Notes Archive". https://www.samba.org/samba/history/samba-3.4.0.html. 
  14. "Samba - Release Notes Archive". https://www.samba.org/samba/history/samba-3.5.0.html. 
  15. "Samba - Release Notes Archive". https://samba.org/samba/history/samba-3.6.0.html. 
  16. "Samba - opening windows to a wider world". https://www.samba.org/samba/news/releases/4.0.0.html. 
  17. "Samba 4.0.0TP1 Available for Download". https://news.samba.org/releases/4.0.0tp1/. 
  18. "Samba - Release Notes Archive". https://www.samba.org/samba/history/samba-4.2.0.html. 
  19. "Samba - Release Notes Archive". https://www.samba.org/samba/history/samba-4.3.0.html. 
  20. "Samba - Release Notes Archive". https://www.samba.org/samba/history/samba-4.4.0.html. 
  21. "Release Notes for Samba 4.8.0". 13 March 2018. https://www.samba.org/samba/history/samba-4.8.0.html. 
  22. "Samba 4.9.0 - Release Notes". https://www.samba.org/samba/history/samba-4.9.0.html. 
  23. "Samba 4.14.0 - Release Notes". https://www.samba.org/samba/history/samba-4.14.0.html. 
  24. "Samba 4.15.0 - Release Notes". https://www.samba.org/samba/history/samba-4.15.0.html. 
  25. "Samba 4.16.0 - Release Notes". https://www.samba.org/samba/history/samba-4.16.0.html. 
  26. "Samba 4.17.0 - Release Notes". https://www.samba.org/samba/history/samba-4.17.0.html. 
  27. "Samba 4.18.0 - Release Notes". https://www.samba.org/samba/history/samba-4.18.0.html. 
  28. "Samba 4.19.0 - Release Notes". https://www.samba.org/samba/history/samba-4.19.0.html. 
  29. CVE-2012-1182 - A security announcement regarding a major issue with Samba 3.6.3 and lower.
  30. "Badlock". http://badlock.org/. 
  31. "Microsoft, Samba Patch "Badlock" Vulnerability". http://www.listythings.com/microsoft-samba-patch-badlock-vulnerability/. 
  32. 32.0 32.1 "Samba 4.6.4 - Release Notes". 24 May 2017. https://www.samba.org/samba/history/samba-4.6.4.html. 
  33. "SambaCry is coming" (in en-us). Securelist - Kaspersky Lab’s cyberthreat research and reports. https://securelist.com/sambacry-is-coming/78674/. 
  34. Cimpanu, Catalin. "Microsoft says it detected active attacks leveraging Zerologon vulnerability" (in en). ZDNet. https://www.zdnet.com/article/microsoft-says-it-detected-active-attacks-leveraging-zerologon-vulnerability/. 
  35. Constantin, Lucian (23 September 2020). "What is Zerologon? And why to patch this Windows Server flaw now" (in en). https://www.csoonline.com/article/3576193/what-is-zerologon-why-you-should-patch-this-critical-windows-server-flaw-now.html. 
  36. "UNIX Extensions". https://wiki.samba.org/index.php/UNIX_Extensions. 
  37. "ArcaMapper". https://www.arcanoae.com/wiki/arcamapper/. 
  38. "Chapter 37. SWAT: The Samba Web Administration Tool". http://us3.samba.org/samba/docs/man/Samba-HOWTO-Collection/SWAT.html. 
  39. "SWAT your Samba problems". linux.com. 31 January 2008. https://www.linux.com/news/swat-your-samba-problems/. 
  40. "Samba 4.1 Features added/changed". https://wiki.samba.org/index.php/Samba_4.1_Features_added/changed. 
  41. "Project FAQ - What is the relationship between Samba and Samba TNG?". https://wiki.samba-tng.org/doku.php/pages/faq#what_is_the_relationship_between_samba_and_samba-tng. 
  42. "Project FAQ - Which should I use - Samba or Samba TNG?". https://wiki.samba-tng.org/doku.php/pages/faq#which_should_i_use_-_samba_or_samba-tng. 
  43. "Project FAQ - What's all this about FreeDCE?". https://wiki.samba-tng.org/doku.php/pages/faq#what_s_all_this_about_freedce. 
  44. Vincent, Brian. "Interview with Steven Edwards". Wine HQ. http://www.winehq.org/?interview=14. 

External links