Samba (software)

This article is about computer software. For other uses, seeSamba (disambiguation).

Samba

Initial release	1992(1992)
Stable release	4.21.1 / 14 October 2024
Repository	git.samba.org
Written in	C,Python
Operating system	Multiplatform
Type	Network file system
License	2008:GPL-3.0-or-later 1993:GPL-2.0-or-later 1992: Proprietary
Website	www.samba.org

Sambais afree softwarere-implementation of theSMBnetworkingprotocol,and was originally developed byAndrew Tridgell.Samba providesfileandprintservicesfor variousMicrosoft Windowsclientsand can integrate with a MicrosoftWindows Server domain,either as aDomain Controller(DC) or as a domain member. As of version 4, it supportsActive Directoryand MicrosoftWindows NTdomains.

Samba runs on mostUnix-likesystems, such asLinux,Solaris,AIXand theBSDvariants, including ApplemacOS(Mac OS X 10.2and greater) andmacOS Server.Samba also runs on a number of other operating systems such asOpenVMSandIBM i.Samba is standard on nearly all distributions of Linux and is commonly included as a basicsystem serviceon other Unix-based operating systems as well. Samba is released under the terms of theGNU General Public License.The nameSambacomes from SMB (Server Message Block), the name of the proprietary protocol used by the Microsoft Windows network file system.

Early history

Andrew Tridgelldeveloped the first version of Samba Unix in December 1991 and January 1992, as a PhD student at theAustralian National University,using apacket snifferto donetwork analysisof the protocol used byDECPathworksserver software. It did not have a formal name at the time of the first releases, versions 0.1, 0.5, and 1.0, all from the first half of January 1992; Tridgell simply referred to it as "a Unix file server for Dos Pathworks." He understood that he had "in fact implemented the netbios protocol" at the time of version 1.0 and that "this software could be used with other PC clients."

With a focus oninteroperabilitywith Microsoft'sLAN Manager,Tridgell released "netbios for unix", observer, version 1.5 in December 1993. This release was the first to include client-software as well as a server. Also, at this time GPL2 was chosen as license.

Midway through the 1.5-series, the name was changed tosmbserver.However, Tridgell got atrademarknotice from the company "Syntax", who sold a product namedTotalNet Advanced Serverand owned the trademark for "SMBserver". The name "Samba" was derived by running the Unix commandgrepthrough thesystem dictionarylooking for words that contained the letters S, M, and B, in that order (i.e.grep-i'^s.*m.*b'/usr/share/dict/words).

Versions 1.6, 1.7, 1.8, and 1.9 followed relatively quickly, with the latter being released in January 1995. Tridgell considers the adoption ofCVSin May 1996 to mark the birth of the Samba Team, though there had been contributions from other people, especiallyJeremy Allison,previously.

Version 2.0.0, released in January 1999, was a major release, support for authentication from Windows NT Primary Domain Controller, 64 bit filesystem support for very large files, and exposure of OPLOCKS to unix systems.Version 2.2.0 released in April 2001.

Version history

Date	Version	Description
23 September 2003	Old version, no longer maintained:3.0	Active Directory support.The 3.0.x series officially reached end-of-life on 5 August 2009.
1 July 2008	Old version, no longer maintained:3.2	It will be updated on an as-needed basis for security issues only.There was a change of license from GPL2 to GPL3, with some parts released under LGPL3.The 3.2.x series officially reachedEOL1 March 2010.
27 January 2009	Old version, no longer maintained:3.3
3 July 2009	Old version, no longer maintained:3.4	This was the first release to include both Samba 3 and Samba 4 source code.
1 March 2010	Old version, no longer maintained:3.5	This was the first release to include experimental support forSMB2.
9 August 2011	Old version, no longer maintained:3.6	This is the first branch which includes full support for SMB2.
11 December 2012	Old version, no longer maintained:4.0	It is a major rewrite that enables Samba to be an Active Directory domain controller, participating fully in a Windows Active Directory Domain. Its first technical preview (4.0.0TP1) was released in January 2006 after 3 years of development.
10 October 2013	Old version, no longer maintained:4.1	support forSMB3
4 March 2015	Old version, no longer maintained:4.2	Btrfsbased file compression, snapshots andwinbindintegration
8 September 2015	Old version, no longer maintained:4.3	New Logging features, SMB 3.1.1 support
22 March 2016	Old version, no longer maintained:4.4	Asynchronous flush requests
7 September 2016	Old version, no longer maintained:4.5	NTLM v1 disabled by default, Virtual List View, Various performance improvements
7 March 2017	Old version, no longer maintained:4.6	Multi-processNetlogonsupport
21 September 2017	Old version, no longer maintained:4.7	Samba AD with MITKerberos
13 March 2018	Old version, no longer maintained:4.8	AppleTime MachineSupport. Setups using 'domain' or 'ads' security modes now require 'winbindd' to be running.
13 September 2018	Old version, no longer maintained:4.9	Many changes
19 March 2019	Old version, no longer maintained:4.10
17 September 2019	Old version, no longer maintained:4.11	SMB1 is disabled by default as a mitigation for theWannaCryvulnerability.
3 March 2020	Old version, no longer maintained:4.12
22 September 2020	Old version, no longer maintained:4.13	Samba 4.13 raises the minimum version of Python to 3.6.
9 March 2021	Old version, no longer maintained:4.14	Major overhaul of VFS subsystem and more.
20 September 2021	Old version, no longer maintained:4.15	Many changes.
21 March 2022	Old version, no longer maintained:4.16	Many changes.
13 September 2022	Old version, yet still maintained:4.17	Many changes.
8 March 2023	Old version, yet still maintained:4.18	Many changes.
4 September 2023	Current stable version:4.19	Many changes.
27 March 2024	Current stable version:4.20	Many changes.

Security

Some versions of Samba 3.6.3 and lower suffer serious security issues which can allow anonymous users to gainrootaccess to a system from an anonymous connection, through the exploitation of an error in Samba'sremote procedure call.

On 12 April 2016, Badlock,a crucial security bug in Windows and Samba, was disclosed. Badlock for Samba is referenced by CVE|2016-2118 (SAMR and LSA man in the middle attacks possible).

On 24 May 2017, it was announced that a remote code execution vulnerability had been found in Samba namedEternalRedorSambaCry,affecting all versions since 3.5.0.This vulnerability was assigned identifier CVE|2017-7494.

On 14 September 2020, a proof-of-conceptexploitfor the netlogonvulnerabilitycalledZerologon(CVE|2020-1472) for which apatchexists since August was published.Some federal agencies using the software have been ordered to install the patch.

Features

Samba allows file and print sharing between computers running Microsoft Windows and computers running Unix. It is an implementation of dozens ofservicesand a dozen protocols, including:

• NetBIOSoverTCP/IP(NBT)
• SMB(known as CIFS in some versions)
  • Samba supports POSIX extensions for CIFS/SMB. The initial extension was CIFS VFS (CAP_UNIX) from 2004, which has been somewhat superseded by SMB3.
• DCE/RPCor more specifically,MSRPC,the Network Neighborhood suite of protocols
• AWINSserver also known as a NetBIOS Name Server (NBNS)
• The NT Domain suite of protocols which includes NT Domain Logons
• Security Account Manager(SAM) database
• Local Security Authority(LSA) service
• NT-style printing service (SPOOLSS)
• NTLM
• Active Directory Logon using modified versions ofKerberosandLDAP
• DFSserver

All these services and protocols are frequently incorrectly referred to as just NetBIOS or SMB. The NBT (NetBIOS over TCP/IP) and WINS protocols, and their underlying SMB version 1 protocol, are deprecated on Windows. SinceWindows VistatheWS-Discoveryprotocol has been included along with SMB2 and its successors, which supersede these. (WS-Discovery is implemented onUnix-likeplatforms by third partydaemonswhich allow Samba shares to be discovered when the deprecated protocols are disabled).

Samba sets upnetwork sharesfor chosen Unixdirectories(including all contained subdirectories). These appear to Microsoft Windows users as normal Windows folders accessible via the network. Unix users can eithermountthe shares directly as part of their file structure using the mount.cifs command or, alternatively, can use a utility, smbclient (libsmb) installed with Samba to read the shares with a similar interface to a standard command lineFTPprogram. Each directory can have different access privileges overlaid on top of the normal Unix file protections. For example: home directories would have read/write access for all known users, allowing each to access their own files. However they would still not have access to the files of others unless thatpermissionwould normally exist. Note that the netlogon share, typically distributed as a read only share from/etc/samba/netlogon,is the logon directory for user logon scripts.

Samba services are implemented as twodaemons:

• smbd, which provides the file and printer sharing services, and
• nmbd, which provides the NetBIOS-to-IP-address name service. NetBIOS over TCP/IP requires some method for mapping NetBIOS computer names to the IP addresses of a TCP/IP network.

Samba configuration is achieved by editing a single file (typically installed as/etc/smb.confor/etc/samba/smb.conf). Samba can also provideuser logon scriptsand group policy implementation throughpoledit.

Samba is included in most Linux distributions and is started during the boot process. On Red Hat, for instance, the/etc/rc.d/init.d/smbscript runs at boot time, and starts both daemons. Samba is not included in Solaris 8, but a Solaris 8-compatible version is available from the Samba website. TheOS/2-basedArcaOSincludes Samba to replace the oldIBM LAN Serversoftware.

Samba includes a web administration tool calledSamba Web Administration Tool(SWAT). SWAT was removed starting with version 4.1.

Samba TNG

Samba TNG (The Next Generation) wasforkedin late 1999, after disagreements between the Samba Team leaders and Luke Leighton about the directions of the Samba project. They failed to come to an agreement on a development transition path which allowed the research version of Samba he was developing (known at the time as Samba-NTDOM) to slowly be integrated into Samba.Development has been minimal, due to a lack of developers. The Samba TNG team frequently directed potential users towards Samba because of its better support and development.

A key goal of the Samba TNG project was to rewrite all of the NT Domains services asFreeDCEprojects.This was made difficult as the services were developed manually through network reverse-engineering, with limited or no reference to DCE/RPC documentation.

A key difference from Samba was in the implementation of the NT Domains suite of protocols andMSRPCservices. Samba makes all the NT Domains services available from a single place, whereas Samba TNG separated each service into its own program.

ReactOSstarted using Samba TNG services for its SMB implementation. The developers of both projects were interested in seeing the Samba TNG design used to help get ReactOS talking to Windows networks. They worked together to adapt the network code and build system. The multi-layered and modular approach made it easy to port each service to ReactOS.

See also

• LM hash
• SSLBridge

External links

• Official website