To a long-time SMB developer the NFSv4 RFC looks remarkably familiar. In an effort to provide interoperable locking infrastructure, I have taken a closer look at what NFSv4 provides. This talk will present my current understanding of where NFSv4 and SMB provide similarities and where a common infrastructure could benefit both protocols

Slides (PDF)

Recording

Another great year of progress in improving access to Samba and other servers from Linux. The Linux SMB3.1.1 client, cifs.ko, continues to be one of the most active filesystems in Linux. With many improvements added each year to securely, reliably and efficiently access remote data, it has been an exciting year. This presentation will cover new features added to the Linux client, and new features you can expect to see over the coming year. Whether accessing data from the smallest devices or the largest (and even the cloud), getting at remote files matters. Over the past year, significant improvements have been made to metadata and directory caching, multichannel performance, POSIX/Linux compatibility, security enhancements, symlink handling, remote swapfiles, improved readahead, better file caching, improved TMPFILE support, and broader support for special file types.

Slides (PDF)

Recording

When samba is joined to a domain, the domain users and groups are available in the local system so one can for example set a file owner to an AD user. This mechanism works thanks to the Name Service Switch (NSS), the mechanism used to retrieve user information from different services, each one providing a pluggable module in the form of a dynamic loadable library. Samba provides the nss_winbind.so module, which uses libwbclient to talk to Winbind daemon, to resolve user and group information from a Windows Domain.

This just works fine for traditional servers, but the world is moving to containerized workloads and this presents new challenges for Samba. What happens for example if we want to run winbindd in a container and smbd in another one? Or if we want to run winbindd in a container but have AD users available on the host? Do we need to install nss_winbind.so and libwbclient everywhere?

This talk will present the systemd's User and Group lookup API and the implementation of the io.systemd.UserDatabase interface in winbind, which provides user and group name resolution through nss_systemd as an alternative to nss_winbind. There will also be a demo to show how it can help in the exposed scenario.

Slides (PDF)

Recording

Welcome to the sambaXP 2024 Microsoft Interoperability Track!

We will start with a brief overview of the Open Specifications program and other interoperability resources that can help your development efforts. Then, a deep dive into SMB testing and parsing and a chance to meet and chat with the SMB development team. The track will also feature a taste of the M365 Interoperability for Teams and Exchange.

Slides (PDF)

Recording

Samba 4.20 will ship with rpcd_witness, which provides a service for MS-SWN within a ctdb cluster. This service can be used by a client in order to monitor cluster nodes and gives an administrator the chance to move specific connection to another node.
This talk explains the current state, the design and some strange things a Windows client is doing.

Slides (PDF)

Recording

The FreeIPA project relies on MIT Kerberos for its KDC service. Fixing the Bronze-Bit vulnerability (CVE-2020-17049) has been particularly challenging on CentOS Stream/RHEL 8, because the solution designed by Microsoft was not practicable in this context.

In this presentation, I explain what this vulnerability is, how it is meant to be fixed, and how it was actually handled on CentOS Stream/RHEL 8. I support these explanations with step-by-step sequence diagrams.

Slides (PDF)

Recording

Unlock the secrets behind connecting Linux seamlessly with Entra ID (formerly Azure AD). Dive deep into the intricacies of device joins, OAuth2 authentication, and TGT retrieval. Explore hands-on experiences using Rust. Join me in bridging the gap between Linux and Entra ID, unlocking a world of possibilities for enhanced integration.

Slides (PDF)

Recording

Microsoft Teams is cloud-based team collaboration software that is part of the Microsoft 365 and Office 365 suite of applications. Learn how to develop an App that leverages Microsoft Graph or other publicly available APIs to get M365 content seamlessly.

Slides (PDF)

Recording

In Active Directory, KCC stands for “Knowledge Consistency Checker”, which is an outstandingly non-descriptive term even by the standards of the field. It is periodically run on all DCs to calculate a replication graph for the domain, so that changes on each DC are replicated to the others via an efficient route.

The KCC runs independently on each DC, using the network description in the database, and it needs to come up with the same answer on all DCs. For the perhaps obsolete reason of economizing on inter-site traffic, it creates a sparse tree between sites but well connected graphs within sites.

The algorithm needs to be robust at all networks scales, and cope with changes over time and with mixed networks of different versions of Windows and Samba.

Samba's KCC implementation was written in Python, largely by people who didn't really know what they were doing (for example, me). It has some terrible workarounds for the Python binding bugs we had at the time.

The combination of inherently complex algorithm and some awful Python is enhanced by a tersely written specification. This makes it hard for anyone to work out what the KCC is actually doing, and whether what it is doing is what it means. I will try to explain what is going on, and maybe add some words about what we could do differently.

Slides (PDF)

Recording

Overview of Exchange Server Protocols and Documentation. How to communicate with on-prem Exchange Server, what protocol family to choose, and introduction to alternative APIs (MS Graph).

Slides (PDF)

Recording

The effort to integrate the Samba AD service with OpenLDAP has been going, off and on, for a few years now. While the idea to replace Samba's LDAP server with OpenLDAP is far from dead, the actual implementation plan has evolved, largely because of the progress Samba has made over the years, such as its LMDB back-end. What started as an effort to revive the long defunct OpenLDAP back-end for Samba and use it as a base to gradually port Samba functionality as overlay modules, is being transformed into a different type of integration - execute Samba's LDB module stack inside OpenLDAP, with the possibility to optimize it for better performance. The purpose of this talk is to give some history on the project development so far, explain the new direction, and present the challenges it faces.

Slides (PDF)

Recording

For a while now we have been fuzzing many parts of Samba using OSS-Fuzz and private runs. What have we learnt?

Slides (PDF)

Recording

Join me for an informative and interactive session as we explore the latest developments in Linux Group Policy. We'll dive into the various policies and how they can help you manage and secure your organization's network infrastructure. Additionally, I'll be highlighting new documentation, which provides step-by-step instructions on setting up Linux Group Policy.

Slides (PDF)

Recording

With the past 1-2 releases Samba has matured itself on the new VFS implementation rooted on the handle based approach for accessing the underlying UNIX file systems. Irrespective of the type of file system beneath it Samba successfully tackles the symbolic link race condition to the fullest. GlusterFS being a software defined distributed file system has always tried to keep up with the major changes in Samba to make use of safe and sound mechanisms in providing data access to SMB clients. But what are the challenges involved? How do we comply with pathref changes in Samba to ensure seamless service to end-users? In this talk we closely look at the changes done at the VFS module for GlusterFS as an attempt to adapt itself to the new VFS structure. As we move forward we also highlight the bugs (and improvements) discovered in this process with a note on overall performance impact on such distributed file systems.

Slides (PDF)

Recording

SambaXP 2022 was supposed to give a perspective on RHEL 9.0 experience in making Active Directory interoperability possible in FIPS 140-3-compliant environments. The talk was canceled for health reasons. Since that time, we have found a few more stumbling stones on the path to make Samba and FreeIPA interoperate with Active Directory while being compliant with FIPS 140-3. This talk aims to cover our progress in understanding and solving tightened crypto requirements within the authentication and identity management area.

Slides (PDF)

Recording

With the increasing amount of network throughput, we'll reach a point where a data copies are too much for a single cpu core to handle.

This talk gives an overview about how the io_uring infrastructure of the Linux kernel could be used in order to avoid copying data, as well as spreading the load between cpu cores. A prototype for this exists for quite some time and shows excellent results.

The talk will explain:

• What the current implementation status is
• How the proposed design looks like
• What challenges we are hitting in bringing it upstream

Slides (PDF)

Recording

To implement smb2 unix extensions, smbd needs to implement ntfs reparse points to present symlinks, sockets and other special files to clients. This talk will present an overview of what reparse points are at their core and where Samba stands to implement them. This talk will serve as the basis for discussion about how Samba should go forward to implement smb2 unix extensions.

Slides (PDF)

Recording

An overview of the available interoperability resources and programs. This talk will introduce the Open Specifications and highlight all major technology areas of the site – Windows, Office, SharePoint, Exchange, SQL, as well as types of content – Protocols, Standards, File Formats, Data Portability and Languages.

Slides (PDF)

Recording

WOPI and FSSHTTP are important protocols in the overall Office protocol landscape. This session will provide an overview of how the WOPI and FSSHTTP protocols function and provide resources that will allow you to learn more. 

Slides (PDF)

Recording

For the past several years FreeIPA and SSSD teams have been working on enabling end to end passwordless access in centralized and local environments, be it corporate or home deployment. This talk will go into details of our progress in passwordless access implementation for Linux systems. What can be shared across FreeIPA and Samba AD in this area?
In 2022 FreeIPA project introduced the ability to authenticate users against OAuth2 identity providers (IdPs). This functionality allows to obtain Kerberos credentials after authentication and authorization has been done by the external IdP. As many OAuth2 IdPs allow passwordless authentication with WebAuthn tokens, a true passwordless transition across Linux systems is now available, from login to console, raising privileges within PAM services (e.g. sudo access), to accessing remote systems over SSH. We hope to expand this support with native FIDO2/WebAuthn integration as well.
The work is not complete yet and needs a lot of collaboration across multiple open source projects. Come to the talk to see a demo and discuss how we can improve our passwordless experience together.

Slides (PDF)

Recording

Learn about the Office Open XML file format and Azure Cognitive Services by using just a few lines of code and the Open XML SDK with Azure Cognitive Services for Language, to redact personally identifiable information from a Word document and save it to a new file.

Slides (PDF)

Recording

Samba will soon have full support for AD claims and conditional ACEs. But what are these good for apart from being able to tout functional level 2012 support? And what do these words actually mean? We'll try to find answers.

Slides (PDF)

Recording

Now that Samba server has support for the SMB3.1.1 POSIX Extensions, this presentation will give a demo of some of the features enabled by the SMB3.1.1 POSIX extensions (with examples to multiple servers including Samba and ksmbd) – and how this can help common workloads.    

As Linux continues to evolve, adding syscalls every year – this presentation will also cover some of the places where additional extensions (or emulation) could help.  

Slides (PDF)

Recording

After some neglect I have restarted some effort around WSP (windows search protocol) support
There is currently an upstream merge request to add a simple WSP search client for samba.

This talk will recap the previous WSP efforts, additionally it will introduce the client and what you can do with it.

What about the server side ? I'll talk about my plans about that too and also some of the choices and challenges around that.
 

Slides (PDF)

Recording

The Linux SMB3.1.1 client continues to be one of the most active filesystems in Linux, with many improvements added each year, enhancing its ability to securely, reliably and efficiently access remote data. This presentation will cover new features added to the Linux client, and new features you can expect to see over the coming year. 

Slides (PDF)

Recording

Google Summer Of Code is a yearly event that allows university students to gain more experience and help Open Source projects to improve. In 2020 Samba Team was allocated
a single seat in the program. We chose to work on a modern web UI to samba-tool to allow
automation and easier access to command line tools.

The talk will go over our experience with GSoC 2020 and will show-case its result: a Samba AD DC plugin to Cockpit UI. Cockpit is a Web UI framework to manage Linux systems in a
browser.

Slides (PDF)

The Windows SMB server doesn't offer any way to dump the cryptographic keys used for SMB encryption. This can be very annoying when you're trying to debug your client implementation or if you simply want to decrypt traffic in Wireshark. The server is
sadly closed-source and is implemented as a kernel module, which makes debugging it more challenging.

This talk will cover some of the architecture of the Windows SMB server, how to debug the
Windows kernel, and how we can write another module to dump those keys from the server memory. All from the perspective of a Linux developer relatively new to the world of
Windows development.

Slides (PDF)

To the newcomer, Samba's command line user interface appears to be a haphazard jumble of scripts and binaries with options and design principles that fade in and out of use according to some esoteric pattern.

With Samba 4.15 there will be a major rewrite of the command line parser for Samba client utilities coming. There will be the same design principle to every tool and the same options.

The talk will look into how we solved those issues and how we will avoid issues in future. Also we will look how options changed or have been simplified to make the tools easier to use by newcomers.

Will we get shell-completion one day?

Slides (PDF)

Samba had experimental support for multi-channel for quite a while.
SMB3 has a few concepts to replay requests safely.
We now implement them completely (and in parts better than a Windows Server).

The talk will explain how we implemented the missing features.

With the increasing amount of network throughput, we'll reach a point where a data copies are too much for a single cpu core to handle.

This talk gives an overview about how the io_uring infrastructure of the Linux kernel could be used in order to avoid copying data, as well as spreading the load between cpu cores. A prototype for this exists and shows excellent results.

• What the current implementation status is
• How the proposed design looks like
• How to improve performance

Slides (PDF)

Winbind can now seemlessly replace Vintela's proprietary Group Policy (VGP) for linux clients. These recent developments will be discussed, along with recently added samba-tool commands for administering these policies. Plans for future improvements and possible projects will be discussed.

Slides (PDF)

The SMB protocol was designed long after Unix was created, and as a result supported concepts like globally unique identities and rich ACLs that are in Windows, but not in Linux. User identity and access control are very relevant to the Linux SMB3 client, as it acts as a bridge between the world of Windows-like-filesystems (including the cloud) and the world of Linux filesystems, and has the hard task of translating security information from the more complex Samba and Windows world, to the simpler Linux/POSIX model.

There are three key problems:

1. Id-mapping: Who the user is? And how does it map to the user that the server understands?
2. Authentication: Can the user prove his/her identity?
3. Access control: What permissions does the user have for this file?

This talk will discuss and demonstrate the different ways that the Linux client can be configured to map POSIX permissions (mode bits) to ACLs, and the implications of using these configurations. It will discuss the different authentication choices, especially how to leverage Samba’s winbind for easy to use and highly secure Kerberos authentication and key refresh. In addition it will discuss how to integrate with Samba’s winbind to map user identities (from the local Linux client’s UIDs to globally unique SIDs) and the various alternatives like “idsfromsid”.  Recent improvements in cifs-utils for managing ACLs and auditing information remotely will also be discussed, which can make managing Samba server easier in some cases.

Slides (PDF)

IBM Spectrum Scale is a software defined storage offering of a clustered file system bundled with other services. Samba is included as part of the product for providing a clustered SMB file server and integration into Active Directory environments. This product is commonly used in Enterprise IT environments.

Troubleshooting problems is an essential part of supporting customers. This talk will walk through Samba troubleshooting approaches that have proven useful over the years. It will explain how for this environment Samba is configured to provide logs and indications by default. Methods for collecting additional trace data are demonstrated and how to efficiently analyze these traces. Examples will be used to illustrate debugging problems from the trace data.

Slides (PDF)

Wide-scale virtual-machine deployments of Windows clients and servers make it difficult to adapt to the classic process of domain joining. Very often there is no connection to an AD domain controller. Sometimes a larger number of virtual machines needs to be joined without the vms even being started. And sometimes machines need to be joined in locations where there are no (writeable) domain controllers available at all. For all these scenarios the concept of Offline Domain Join has been developed and is part of the Windows operating systems for quite some time now. This concept allows to detach the machine account creation on AD from the modification of the machine that is joined. In addition to the machine account credentials Group Policies and Certificates can be deployed with the Offline Domain Join mechanism and tools as well. Samba now also can take part in this process. With the latest version, Samba can provision machine accounts for offline join in Active Directory (for both Windows and Samba clients) and process offline join state information on the local, disconnected machine (with state information either generated on Windows or using Samba). This feature enables scenarios where Samba servers are deployed ad-hoc in a containerized infrastructure such as Kubernetes.

Slides (PDF)

The Zambezi SMB3 Offload project was introduced at last year's sambaXP conference.  This brief talk will provide an update on the project, where it's heading, what development has stalled, and what new progress is being made.

Slides (PDF)

Over the last two years, Samba has grown fuzzing infrastructure. This has found numerous bugs given us some reassurance about the robustness of some parts of the code.

Nevertheless, most of Samba is not fuzzed, and lib/fuzzing is just another isolated subsystem that hardly any developers understand. This talk wants to fix that, walking you through the steps to add a fuzzer to Samba, and how in general to make your code fuzzable.

Slides (PDF)

cifsd(ksmbd) is a new SMB3 kernel server which implements server-side SMB3 protocol. Many changes and improvements have been made since cifsd(ksmbd) was introduced to earlier sambaXP 2019.

This talk will give ksmbd overview and the current status update.

Slides (PDF)

Over the last two years, Samba has grown fuzzing infrastructure. This has found numerous bugs given us some reassurance about the robustness of some parts of the code.

Nevertheless, most of Samba is not fuzzed, and lib/fuzzing is just another isolated subsystem that hardly any developers understand. This talk wants to fix that, walking you through the steps to add a fuzzer to Samba, and how in general to make your code fuzzable.

The effort to modernize Samba's VFS interface has reached a major milestone with the next release Samba 4.14.

Starting with version 4.14 Samba provides core infrastructure code that allows basing all access to the server's filesystem on file handles and not on paths. An example of this is using fstat() instead of stat(), or SMB_VFS_FSTAT() instead of SMB_VFS_STAT() in Samba parlance.

Historically Samba's fileserver code had to deal a lot with processing path based SMB requests. While the SMB protocol itself has been streamlined to be purely handle based starting with SMB2, large parts of infrastructure code remains in
place that will "degrade" handle based SMB2 requests to path based filesystem access.

In order to fully leverage the handle based nature of the SMB2 protocol we came up with a straight forward way to convert this infrastructure code, so it can be converted to make use of a purely handle based VFS interface.

The talk will present what we have achieved so far and what is left to do. It's intented audience is anyone working on the Samba fileserver code and anyone working on Samba VFS modules.

Slides (PDF)

The classic Samba RPC services like srvsvc, winreg and wkssvc right now are implemented as part of the smbd binary and process.

This talk will give an overview of experiments to change this architecture: Instead of implementing RPC services by linking the server implementation into smbd, an idea is to implement them as separate binaries and separately executed process.

Red Hat has in the past implemented spoolss and other RPC services as separate processes, but the attempt this talk will present goes one step further: Instead of just forking the main smbd process perform RPC server services, a separate binary can be executed.

This talk will present the architecture of this thought experiment and demonstrate the current state of the code.

Slides (PDF)

The Linux client continues to be the most active network/cluster filesystem on Linux over the past year, and the progress on Samba server and the Linux kernel server has helped make adding new features to the SMB3.1.1 client in Linux even more important.

It has been a great year for SMB with the addition of many security improvements, many performance improvements including to caching and RDMA (smbdirect) as well as dramatic improvements to multichannel. Support for the Witness protocol (allowing transparent movement to a different server) has been added, as well as the new more feature rich Linux mount API. In addition support for the final piece of the optional SMB 3.1.1 POSIX protocol extensions was completed. Tooling has been improved with many new features added to tools like smbinfo, and support for easily getting and setting more auditing and security information.

This presentation will go through some of the new features added to the Linux client over the past year, and demonstrate the great progress in access various types of network storage, including the cloud (e.g. Azure), Samba and the new Linux kernel server.

Slides (PDF)

A Deep Dive into testing the Linux client against Samba - to see which Linux APIs are supported, which POSIX features work and what still needs to be addressed

File systems in Linux are complex, having to support over a hundred system calls (far more than POSIX specified), and Linux continues to evolve, adding new file system features and system calls every year. How compliant is the Linux client when mounted to Samba or other common servers? What about if the SMB3.1.1 POSIX Extensions are used? What works now with and without the extensions?

This presentation will summarize what we have found out from analyzing results of the standard Linux file system functional test suite ("xfstests") as well as other Linux tests and customer problems - showing what we have fixed, what works to most servers now (and how to configure best for these), what types of applications require mounting with the SMB3.1.1 POSIX extensions to work, and also show what is missing in the protocol and how we might address these holes.

This is a great opportunity to discuss what minor extensions are needed to the protocol to enable even more Linux workloads over SMB. "xfstests," since they are run against every major Linux filesystem, has been invaluable in pointing out what we need to address in Samba and the Linux client as Linux file system requirements continue to evolve. This presentation will help understand what workloads work well today, and what we have to do for SMB3.1.1 protocol to optimally handle the ever broader set of Linux workloads in the future.

Slides (PDF)

This talk is a status update on TrueNAS and FreeNAS and Samba.

A look at what the Samba team does to make a new Samba security release, from the point of report to the packages or source users
install.

Following Samba Security Process but putting flesh on the bones to give a real idea of the behind-the-curtain effort and care taken to ensure that Samba security issues are addressed promptly, responsibly and carefully.

Slides (PDF)