Samba 3.6 Released With SMB2 Support

Jeremy Allison - Sam wrote in to let us know the Samba project has made a major new release. The main highlight is support for SMB 2.0 which was released as part of Windows Vista. There are a number of other improvements to printing support, clustering, and identity mapping; details can be found in the release notes.

Comments

Awesome

[Anonymous Coward]

I love playing as the Princess since she can float.

Re:Awesome

[kakyoin01]

Good to know I wasn't the only one thinking of this when I read the summary.

About time...

[wo1verin3]

I've been waiting since Sept 1/88. Now if they'd only add support for the light gun my life would be complete.

End of an era?

[vlm]

For the first time in 13 or so years, I'm not admining a samba instance at home or work. Recently killed off the last samba share at home due to some VLAN changes. Mounted filesystems all go over the AFS, or the netatalk. I don't do the "vista" and microsoft thing in general, so that doesn't matter. The macs tolerate the AFS and love the netatalk. The PCs actually work flawlessly as AFS clients, much better than in years past. The unix boxes all use the trinity of AFS / kerberos / ldap, and pretty much, always have used that. Samba, wheres that go, in this picture?

Is there any reason to move back? or light up a new Samba so I could.... ummm

Re:End of an era?

[Richard_at_work]

So you don't use it, does that make it an end of an era?

Like it or not, but there are millions of small offices out there with Windows clients hanging off a Linux file server, so it's anything but the end of an era, especially as SMB2 is actually a much nicer protocol than SMB1.

Re:End of an era?

[vlm]

I personally switched because the alternatives finally worked better, did more of what I wanted, better cross platform support... Its the end of an era where the best LAN protocol for a new deployment is SMB...

I acknowledge that switching is easier when you're only talking about a couple dozen boxes instead of 25K boxes. I suppose they'll always be legacy environments. That does not mean I'm actively interested in new advances in token ring cabling, or IPX/SPX, or decnet.

Re:End of an era?

[mewsenews]

I just looked at AFS on Wikipedia and it looks very interesting.

What implementation of AFS do you use, server side and client side?

Do you have any books or documentation online you could recommend?

Re:End of an era?

[Sancho]

AFS looks pretty complex to set up, whereas Samba is dead simple. Am I missing something?

Re:End of an era?

[Anonymous Coward]

Most people don't know this but Samba invented the network filesystem used by Microsoft.

So it's not really a Microsoft thing even though people seem to assume that because it's what Microsoft uses by default. Although the 2.0 version was at Microsoft's hands. Usually the changes come from Samba first.

Re:End of an era?

[wolrahnaes]

Is there any reason to move back? or light up a new Samba so I could.... ummm

There are two reasons I continue to use Samba: laziness and it "just works" (for most definitions of "works"). Every single even remotely common personal computing platform has a SMB client either built in or readily available. This means that alternatives can't just be equal, they have to be better enough that it justifies the effort involved in installing and configuring the relevant client software rather than just clicking a few buttons and picking the share(s) you want to access.

To directly answer your question, the reason I'd bring back Samba (note, I am not saying to leave AFS but to use it alongside like you already are with netatalk) would be to be able to easily access data from any random computer you may bring on to the network, regardless of operating system, usually without any software installation.

On my home network it's not uncommon for friends to bring their computers over to leech off my 50m internet and get files from my media server, so simple universal guest support is a major thing.

Re:End of an era?

[Anonymous Coward]

Most people don't know this but Samba invented the network filesystem used by Microsoft.

I'm guessing that most people don't know that because that's completely not true.

Re:End of an era?

[sl3xd]

AFS looks pretty complex to set up, whereas Samba is dead simple. Am I missing something?

Must be. All I had to do was apt-get install netatalk and I had home directories. One line per share for additional directories to share took care of everything else. It just worked...

Re:End of an era?

[mrmeval]

Try http://www.coda.cs.cmu.edu/ Coda first it's a derivative of AFS2

Re:End of an era?

[Sancho]

AFS and AFP are not the same thing.

Re:End of an era?

[Anonymous Coward]

wat? samba was a reverse engineering of microsoft's filesharing system.

Re:End of an era?

[Radworker]

Try again, CIFS or SMB was an invention of an IBM employee back in the bad old dos days. Microsoft has used and heavily modified what we now know.

Re:End of an era?

[dunng808]

This guy must frequent Wikipedia.

Re:End of an era?

[halfnerd]

Is Coda still developed? It seemed dead to me last time I went looking into the alternatives (some years ago, I'll admit).

Re:End of an era?

[LingNoi]

Really because I remember listening to an interview with Jeremy Allison who said it was terrible compared to SMB and that the only reason it was invented was to fuck with Samba. I believe this was it. http://www.twit.tv/floww14

Re:End of an era?

[Jeremy Allison - Sam]

The information came from someone within Microsoft who would have known at the time . Still, you make the best of what you have. The main advantage of SMB2 is that the Windows client redirector was completely rewritten and will now do pipelining of reads and writes. No reason that couldn't have been done in SMB1 - Volker did it for our smbclient libraries - but I believe Microsoft were really scared of messing with the SMB1 code. Everyone who knew it well had already left :-) . One of the benefits of no money in Open Source code, most of the original Samba authors are still working on it :-).

Re:End of an era?

[_Shad0w_]

AFS, for a start, is massively too complex for most home users or small business users, unless they have dedicated admins who understand it.

I used AFS at home for a while, combined with Kerberos, for purely geek reasons. Being able to cd in to my friend's home directory in /afs/athena.mit.edu/users/ was amusing for a while. Until you remember that it's still as slow as hell when you're going out over your DSL connection and across the Atlantic to do it.

One of these days I might set it up again with Windows Server as the Kerberos server.

Re:End of an era?

[vlm]

AFS, for a start, is massively too complex for most home users or small business users,

Maybe if you set it up by reverse engineering the source code or watching protocol analyzer streams.

There's enough recipes out there, that if you can bake a cake, you can set up LDAP/Kerberos/AFS. In fact there are recipes that are so detailed they show screenshots and exactly what to type at each stage. Its literally easier than setting up a webserver (I've certainly done both enough times...). You know how you open a quality mouse hardware, and there's a printed poster with a dozen steps of how to install the mouse? Yeah thats the kind of overkill I'm talking about.

If you can't google, you're screwed wrt to figuring out how to install AFS; but lets face it, if you can't google, you're pretty much screwed wrt to life in general, so its not much of an excuse.

Also I suppose it depends on the distro. The Debian packages are up to snuff, thats for sure. I acknowledge it could be a PITA to compile on gentoo, donno.

Re:End of an era?

[_Shad0w_]

The quality of information out there has probably improved quite a bit since I did it then, which was a considerable amount of time ago, really. Well, considerable by the standards of the internet (I suspect it might be getting on for 10 years ago). I was using a stack of OpenAFS, MIT Kerberos and OpenLDAP.

Re:End of an era?

[vlm]

I just looked at AFS on Wikipedia and it looks very interesting.

What implementation of AFS do you use, server side and client side?

Do you have any books or documentation online you could recommend?

Sorry for responding late but thats how it goes. The plain ole off the shelf Debian packages. Debian infrastructure uses LDAP internally, they eat their own dogfood, if there is one piece of infrastructure I'd trust it would be the Debian LDAP packages...

The openafs guys make installable packages for mac and windows clients. Really boring, install and it goes. I am told its a stereotypical windows/mac experience in that either it "just works" or it is simply beyond untroubleshootable. Therefore since its known the clients work great on a happy network, a problem with the clients would indicate some kind of server problems. So the best way to troubleshoot the server is a linux (debian) client. Get the linux clients working, then get the mac clients working, then get the windoze clients working.

Anyway for the new guy, I think the best place to start is getting LDAP working:

http://techpubs.spinlocksolutions.com/dklar/ldap.html

Then convert from ldap stored passwords to kerberos passwords as seen at:

http://techpubs.spinlocksolutions.com/dklar/kerberos.html

That gives you the required infrastructure to run afs:

http://techpubs.spinlocksolutions.com/dklar/afs.html

I kid you not, look at the web page, match it to your screen, type what they say, it just works.

I have no connection w/ spinlock other than respect for their good work.

There is some circularity; as I recall, after setting up AFS you obviously get to go back to LDAP and change your homedirs to "/afs/something.com/users/you".
When you set up LDAP, you'll change your PAM to use LDAP "semi-secure" passwords; then when you set up Kerberos you'll change PAM to use Kerberos passwords instead; Its circular-ish, not like set up LDAP and never touch it again ever.
Also there are optional/bonus things like entering DNS SRV records so clients become "mostly self configuring" which is pretty cool.

One final note, is due to replication, and presumably a decent backup config, this is literally something you do one time and one time only. So you have kerberos "admins" like me who set up a long time ago and frankly can't provide much help on new installs, and the other side of the ecosystem is total noobs who just tried setting it up last week and therefore ALSO can't provide much (useful) advice. Another example is the last time I added a user to LDAP at home was after my youngest daughter was born; that is getting to be a long time ago; so asking me about adding LDAP users is like asking me about the fine details of anything I did during the early Bush years; "I donno". The moral of the story is go slow, think about it, and assume you'll never be able to change this again. For example, its kind of a PITA to change your Kerberos domain name after you set it up, so get it right the first time, you only have to get it right once.

Re:End of an era?

[vlm]

FTP? Webdav? For the leaching, mythtv-web assuming thats what you're doing, or simple http server?

Re:End of an era?

[vlm]

Is Coda still developed? It seemed dead to me last time I went looking into the alternatives (some years ago, I'll admit).

Its dead; although no one develops it, supposedly it works. There's a mailing list with very light traffic, meaning either it never breaks or no one uses it, hard to say.

I've heard it compared to XFS; Its very non-mainstream. Its users like it because of its special abilities. Sometimes it blows up very spectacularly and no one can figure out why. I have nothing against those characteristics; in my youth I dated women just like that. Just know what you're getting into.

Re:End of an era?

[wolrahnaes]

Still not as universal and easy to use as SMB. Neither OS X nor Windows' built-in GUI FTP clients are particularly useful (OS X's is read-only for some reason) and neither of those protocols have autodiscovery. If I open up the network browser on any of my machines, SMB shares are the only ones that will show up on all of 'em. Obviously the Macs also see AFP shares and if I have Avahi set up right it's possible to make WebDAV show up in Windows and Linux.

Again it's about simplicity and universality. Both major commercial OSes and all desktop-focused *nix distros have SMB clients and servers built in out of the box, so that's the best choice for my situation.

Re:End of an era?

[sl3xd]

AFS and AFP are not the same thing.

D'oh. You are correct, sir.

AFS is much more complicated to set up. I've set up & used AFS for a couple of months; AFS then smacked in the face with its shortcomings. AFS isn't a POSIX compliant FS - file locking in particular doesn't follow POSIX semantics, which introduces a number of limitations that aren't immediately apparent.

Fire up KDE or GNOME and watch things break in strange and confusing ways... Home folders for a Linux Desktop typically have some form of database or file that can be accessed by more than one process at once (such as SQLite or even an mbox mail file). File locking is important for GNOME and KDE, and things go awry when AFS is employed.

After fighting it for a couple of months, I gave up on using AFS for home directories. AFS does some neat things, but you have to know its limitations.

Re:End of an era?

[Sancho]

That's very disappointing to hear, but it matches up with the minimal research I'd done. I'd love the feature set (networked, local caching, kinda like Google Gears but for a home directory) but it sounds like a very big hassle with lots and lots of warts.

Re:End of an era?

[sl3xd]

The wards are what pushed me towards NFSv4:
- Kerberos is supported on NFSv4.
- NFSv4 took inspiration from the good things in AFS; a full NFSv4 implementation will have local caching and will be securable over the Internet.
    - If only somebody who has a clue would add support for something other than the old single DES for encryption (as is the case with NFSv3 & current builds of v4 on Linux). Sadly, I'm not that guy.

rdesktop

[tomer]

Now we just need someone to update rdesktop to make use of the new Remote Desktop features of Windows Vista.

Re:rdesktop

[equex]

Now we just need someone to update rdesktop to actually work at all. ftfy.

Re:rdesktop

[somersault]

Huh? I used it all the time at work.. works great.

Re:rdesktop

[Anonymous Coward]

use it every day. works for me.

Re:rdesktop

[tomer]

Now we just need someone to update rdesktop to actually work at all. ftfy.

rdesktop is old and outdated, but the basic features work well with recent versions of Windows, including redirecting sound and disks and automatic logon. The problem is with new features and bugs that never got fixed.

Re:rdesktop

[jedidiah]

I use it often as well. It runs circles around VNC. If that's the result of Linux having a poor client, then the performance of VNC is really sad.

Re:rdesktop

[dannyof47]

Try the fork FreeRDP . A lot of problems with rdesktop have been fixed.

Re:rdesktop

[0123456]

I use it often as well. It runs circles around VNC. If that's the result of Linux having a poor client, then the performance of VNC is really sad.

VNC sucks because it just sends blocks of pixels. RDP, as I understand it, can send blocks of pixels but can also send rendering commands so your local system does the rendering instead (e.g. telling it to draw a line diagonally across the screen rather than drawing the line locally and then sending the entire screen again).

Rather like Unix has been doing with X11 forever, which apparently sucks so bad it has to be replaced with Wayland which will only allow remote display by sending blocks of pixels because no-one ever uses it. Or something.

Re:rdesktop

[somersault]

I find Remote Desktop better for general usage, though when I tried to use 3D Studio Max over a slow encrypted connection, VNC felt more responsive.. I suppose when there is a lot of complex rendering going on it is sometimes better to just send the bitmap than the rendering info!

Windows Vista?

[Diesel Dave]

They released a new version of Windows?

Re:Windows Vista?

[metalgamer84]

Technically...yes, Win7.

SMB 2.0

[IGnatius T Foobar]

A new SMB 2.0 specification?

And how long will it take before Microsoft begins patent litigation against anyone who dares use Samba 3.6 in a commercial product?

Re:SMB 2.0

[gad_zuki!]

Microsoft contributes to Samba and sees it as a necessary product. For mindlessly evil patent abuse, please visit your local Apple store, thanks.

Re:SMB 2.0

[MightyMartian]

Not to let Microsoft off the hook, but between the EU stomping on them and the reality that Samba is used in a helluva lot of different products, they simply can't afford to play hard ball with it. If they try to screw over the Samba team, they're going to piss off a lot of folks that build tech not just for *nix installations, but NASs and the like.

Re:SMB 2.0

[appleLaserWriter]

I think Nintendo is a bigger worry.

Re:SMB 2.0

[Sancho]

Is Samba really more prevalant than FAT? Microsoft sued over FAT a few years ago.

Re:SMB 2.0

[Ost99]

Microsoft today and Microsoft a few years ago are two different companies.

Re:SMB 2.0

[raddan]

Is that true? I thought that the Samba people paid Microsoft for technical docs that a court order required Microsoft to provide. Have things changed?

Re:SMB 2.0

[MightyMartian]

In pure numbers, no, but as a networking and communications protocol, it's all but ubiquitous in the enterprise market. A lot of organizations have built their IT infrastructure around Samba's working with Windows SMB.

Re:SMB 2.0

[Anonymous Coward]

yes, and the comment I posted yesterday was not made by the same person posting this comment. Excuse me while I go weep.

Re:SMB 2.0

[fuzzywig]

Just Microsoft today is two different companies, the left hand doesn't know what the right is up to. Part of M$ sees Samba as being something worth supporting, but it's still possible that a different part of M$ will try and sue them...

I am glad to hear.

[jellomizer]

There is so much Microsoft Bashing going on that projects like Samba tend to get pushed off as "One of those" Project that only support the Evil Microsoft by Conforming to their standards, vs. trying to make Microsoft Better support ours.

But I have found in Real Life, these tools greatly help increase the usage of Open Source systems. As well deminishes the need to use Microsoft Standards. As you setup you Samba Share and a NFS share (or whatever you want to use) that goes to the same files, you allow your organization to move away from those windows desktops.

Re:I am glad to hear.

[Hatta]

I think it's been 10 years since I heard anyone actually put forth the idea that isolationism would be good for open source. Embrace, extend, extinguish worked well for Microsoft. Open Source has done well with just the first two.

Re:I am glad to hear.

[marcosdumay]

You are implying Open Source does not extinguish the systems it extends? All those dead (or zombie) Unix variants would tell a different story.

It's about time to EEE Windows (too bad Exchange still holds).

Re:I am glad to hear.

[Hatta]

No, I mean that extinguish isn't necessarily a goal. Like Linus said, "I'm not out to destroy Microsoft. That will just be a completely unintentional side effect."

Re:I am glad to hear.

[Anonymous Coward]

You don't need the NFS share... Linux works just fine with SMB shares and authentication with likewise-open.

Re:I am glad to hear.

[Jeremy Allison - Sam]

You don't need likewise-open (which might now be better named "likewise-closed" as it's been sold off to another company, probably to "monetize" all the suckers who installed the "free" version :-). Winbindd which ships with Samba will do the authentication and is developed and tested in conjunction with the rest of Samba.

Jeremy.

Re:I am glad to hear.

[Keruo]

Extinguish works in open source as well.
It comes to play right after:
# dmesg | tail -n1
lp0: on fire

Re:I am glad to hear.

[gmhowell]

You don't need likewise-open (which might now be better named "likewise-closed" as it's been sold off to another company, probably to "monetize" all the suckers who installed the "free" version :-). Winbindd which ships with Samba will do the authentication and is developed and tested in conjunction with the rest of Samba.

Jeremy.

Yeah? And WTF makes you such a Samba genius?

(Yes moron moderators, I read his UID. Laugh.)

Re:I am glad to hear.

[Anonymous Coward]

His UID? Seriously? Jeremy Allison-from Wikipedia

Re:I am glad to hear.

[Ed Avis]

In fact, Jeremy Allison (the Samba maintainer) holds officially approved non-Microsoft-puppet status from the Boycott Novell crowd (http://techrights.org/2006/12/31/jeremy-allison-interview/).

Re:I am glad to hear.

[BitZtream]

Jeremy Allison is a Samba developer. He does tend to know more than a little bit about how it works.

His UID is meaningless, the fact that his job is 'maintaining Samba' qualifies him to talk about it

Context for moderators

[tepples]

Among fans of classic video games, "SMB2" refers to the video game Super Mario Bros. 2: Mario Madness for Nintendo Entertainment System. It was the first game where Peach (then known only as Princess Toadstool) was playable. There is another game also called Super Mario Bros. 2: The Lost Levels, a mission-pack sequel to the original Super Mario Bros. that took a long time to get released outside Japan. This one is abbreviated "SMB2 (J)".

Jokes about classic Mario games have been around since the dawn of Samba.

Re:Context for moderators

[Creepy Crawler]

Go look up Doki Doki Panic for Famicom.

That's where US SMB2 came from. It was rebranded with "mario", and tougher. You had to beat the game with all characters, not just 1. And the waterfalls were headache-inducing.

Re:Context for moderators

[ZorinLynx]

-1 for pedantry.

Re:Context for moderators

[Anonymous Coward]

Posts that call for a post to be modded down should be modded down.

Re:Context for moderators

[Artemis3]

Yes, well indeed, "The lost levels" IS SMB2. The other one is an Arabian adventure called Doki Doki Panic, with sprites replaced. Thus, the Americans were fooled :P

See: http://www.progressiveboink.com/archive/dokidokipanic.html

so does it handle subnets yet ??

[Anonymous Coward]

can it handle server1 on subnet .1 with server 2 on subnet .2 and still access both servers from machines on 1 & 2 over a bidirectional vpn ?

Re:so does it handle subnets yet ??

[adolf]

can it handle server1 on subnet .1 with server 2 on subnet .2 and still access both servers from machines on 1 & 2 over a bidirectional vpn ?

In what world is the application supposed to concern itself with such things?

Re:so does it handle subnets yet ??

[Jeremy Allison - Sam]

We've handled that case since the mid 1990's...

Jeremy.

Re:so does it handle subnets yet ??

[condition-label-red]

Folks, it doesn't get any more informative than this! Straight from the source....

No more moderate button :(

[iYk6]

That's funny. If I had a moderate button to go with my moderator points, I'd mod you up.

SMB2 and databases

[DigiShaman]

SMB2 communications occur when you have a Windows Vista (and above) communicating with Server 2008. If you're using XP or Server 2003 in any combination with the newer OS, it steps down to SMB1. The thing to realize is that SMB2 doesn't handle oplocks well. So legacy file-based databases will break and become corrupted when communicating over SMB2.

I can't find the KB, but per Microsoft, they highly recommend using SQL and not files for future databases as SMB2 will most likely break that functionality. I can vouch for this advice as I've seen some strange shit in this regard.

Re:SMB2 and databases

[raddan]

SMB2 doesn't support oplocks?! But oplocks are Microsoft's own thing! Or is this a sneaky way to force people to replace their old Access databases with SQL Servers?

Re:SMB2 and databases

[Anonymous Coward]

Is it this one? Which has a hotfix.

Re:SMB2 and databases

[KiloByte]

There is nothing databases use that regular file handling doesn't. In other words, SMB2 cannot ensure basic consistency.

Avoiding data corruption in corner cases is hard to do, and NFS doesn't go that stellar either, but this regression is something we need to be aware of.

Re:SMB2 and databases

[Anonymous Coward]

Link to the KB or it didn't happen. :)

Re:SMB2 and databases

[iCassius]

KB link, with hotfix: http://support.microsoft.com/kb/2028965

Re:SMB2 and databases

[Anonymous Coward]

If your needs are currently being met with Access, then you would be fine with the free Express (2GB size limit per DB) version of SQL Server. So I don't think that's major goal.

Re:SMB2 and databases

[Tomato42]

I can only say it's a Good Thing, on many levels

Re:SMB2 and databases

[TommydCat]

Mount an SMB2 network share as a drive letter in Windows 7. Tell Firefox to download a file to that drive. Enjoy your corrupted download.

This was biting some of my users after migrating a file sharing server from W2k3 to W2k8r2. This is the future?

Performance for a mixed environement

[Anonymous Coward]

For those of us that have home networks with Win7 machines as desktops and Linux Boxes as file servers, this is a massive improvement. I have to game, so my desktop is windows. Being able to calm my local network traffic is a beautiful revelation. I am truly looking forward to seeing the benchmarks.

AFS?

[Ed Avis]

AFS? As in Andrew File System? I didn't realize anyone used that in the real world still. I thought it had its own on-disk filesystem at the server end and other weird requirements. How do you set up AFS clients on Windows?