Registration

It’s time for your new sambaXP tradition - an update on our efforts to containerize Samba and run and manage it under Kubernetes with our Operator. This will include a brief recap of our goals, along with a summary of some of the new developments we have made since the last sambaXP, including but not limited to clustered Samba instances. We will also have a deeper discussion of our vision of how future containerized Samba versions might work and some of the potential benefits for the general Samba ecosystem.

Jeremy Allison wants to remove symlinks from Unix (see https://lwn.net/Articles/882177/ ). Until they are gone, we will live in the legacy world with symlinks for quite a while. Jeremy Allison and Ralph Böhme have rewritten Samba to make it safe from symlink races. Ralph Böhme has presented most of this work last year at SambaXP under the covers of a general modernization of Samba's VFS.

This talk will be a sequel to Ralph's talk: Work is ongoing to build upon the rewrite of the VFS to utilize directory file descriptors in a lot more places than it is done right now. This work is driven by the hope to express symlink-safety more explicitly in the Samba code using safe directory handles. If this turns out to be successful, Samba will become more resilient against symlink races, future developments will have it easier to remain safe. Also, it will speed up Samba's path-based operations.

On the domain controller side we got a lot of updates recently:

• Updated Heimdal
• Working with the latest MIT Kerberos

On the member server side we fixed some critical bugs and have plans for future improvements how a file server can avoid as much domain controller interaction as possible.

This talk will handle the following questions:

• How Samba plans to use Kerberos FAST?
• How you can reliable change a machine password?
• Why it is so important to behave as exactly identical as possible compared to a Windows server?

Accessing files securely and efficiently matters. Over the past year many improvements have been made to the Linux kernel for accessing files remotely via SMB3.1.1, and it has been a great year for cifs.ko with the addition of new SMB3.1.1 features and optimizations. It continues to be the most active network/cluster file system on Linux. And now with the addition of a kernel server to Linux (ksmbd), there are multiple Linux server options (Samba and ksmbd).

Improvements to performance have been made by adding support for handle leases (deferred close), better optimizing multichannel, and by changes to read ahead caching, and directory and metadata caching and also signing improvements have been made. Offline caching (fscache) has been rewritten and improved, and support for the Witness protocol (server notification about key events like server moving), and security has improved with support for the strongest encryption, and more recently the exciting work on QUIC. This presentation will go through the features added over the past year to the Linux client (and kernel server) and demonstrate how they help common scenarios, from accessing the cloud (like Azure) to accessing Samba, Windows, Macs and the new Linux kernel server (ksmbd).

This presentation will go over what new SMB3 features for accessing files remotely from Linux have been added in the last year and also what SMB3.1.1 improvements are expected in the coming year to allow for more efficient access to remote files.
Improvements to testing, and improvements to commonly used configuration and mount options will also be described. An overview of the status of the Linux kernel server, ksmbd, will also be presented.

This talk will discuss the addition of Certificate Auto Enrollment in Samba Group Policy, what it is and how to use it. Certificate Auto Enrollment allows devices to enroll for certificates from Active Directory Certificate Services.
 

AIX is one of the commercial UNIX flavours which is still actively supported. Installing and running Samba on AIX can be challenging though. This talk is about how to set up and manage Samba on this platform.

In November 2021 Samba and Microsoft, rather oddly, put out a security release on the same day. Not much was said, except 'patch, patch, patch'.

In this talk Andrew describes what that was all about, what we fixed and how, as well as celebrating an incredible cross-team effort supported with engineering from 5 different companies.

We also celebrate (so far) releasing that with few regressions and think about how we can advance the state of security in this area into the future.

This is a report on the status of CTDB, similar to that presented at recent sambaXP conferences.  As usual, this presentation will look back
and summarise progress since the most recent presentation in 2020.  It will also look forward and attempt to present a realistic path for
further development.

The biggest recent change arrived in Samba 4.16.  CTDB's recovery lock is now a cluster lock and, when enabled, a race for this lock is used in place of a traditional election.  This avoids problems where an election would result in a new leader but this leader would be unable
to take the lock.  Reasons for this include races and cluster filesystem latency.

In the past we have presented grand plans, designs and frameworks. This year we will step back a bit and consider what is needed to
realise a shiny new, maintainable CTDB.

This talk is going to give an overview of recent changes in the Samba fileserver and an outlook on the development roadmap. Recent development has been mainly focused on security resulting in the release of Samba 4.15 last year and a rewrite of the RPC server which will ship in the upcoming 4.16.

Looking forward there are many things the Samba fileserver development team has on its todo list and this presentetation will give a first-hand insight into the making of the next Samba versions.

In SambaXP 2021 we looked at how to get Samba working in environments where FIPS 140-2 compliance was required. With RHEL 9 release Samba and FreeIPA will have to work in the environments compliant with FIPS 140-3 requirements.

The talk will describe our progress on making Samba and FreeIPA interoperable with Active Directory with those requirements in place.

The UNIX Filesystem API is profoundly broken, and user-settable symbolic links are to blame. In this talk I will explain how CVE-2021-20316 made me realize that symbolic links are, introduced in 4.2BSD Unix from U.C. Berkeley, broke the previously elegant UNIX filesystem API and filesystem design. The design and implementation of symlinks has cause years worth of security flaws and API patches to fix a conceptually broken idea.

I also propose a modest suggestion in order to help Linux step away from this mess to a more secure by-design future!