samba - Mar 2023 - clients not connecting to samba shares

Op 30-03-2023 om 09:22 schreef Rowland Penny via samba:
>
>
> On 30/03/2023 04:28, Gary Dale via samba wrote:
>
>>
>> Baokports are for people who need something that the stable version 
>> doesn't provide. That's not me. I run Debian/Stable on my
servers for
>> a reason. I run Testing on my workstation because I want to help test 
>> things. And I run it my new laptop because it requires drivers that 
>> aren't available in Stable.
>>
>> Debian does update stable when a serious issue is found that can't
be
>> patched. However that is a vector for breakage - it wasn't that
long
>> ago that an update to ghostscript broke a lot programs in Stable that 
>> used it to produce PDFs. We had to choose between a security flaw or 
>> a lack of functionality.
>>
>> I'll wait until Bookworm becomes Stable to get the Samba upgrade.
>
> Samba is a rapidly evolving thing, blink and you miss something, in my 
> opinion you need to keep up to date.
>
> Debian does, like most distros, backport Samba patches, but it doesn't 
> backport everything. There was a large change at Samba 4.16.0, the 
> entire Heimdal was replaced with a very newer version and if you have 
> any Windows 11 or up to date Windows 10 machines, you are going to 
> need it. I do not think that Debian has backported that change to the 
> 4.13.x series it provides in the standard Debian 11 repo, but it is in 
> the 4.17.6 version from backports (which, as far as I understand, is 
> exactly the same version that Debian 12 will supply)
>
> It is your computer and you get to decide what you run on it, but when 
> the Debian Samba maintainer and a member of the Samba team are both 
> advising using backports, then you may want to wonder why.
>
> Rowland
>
>
To add to this, if you do not want everything from backports then use 
apt-pinning so that you just get the Samba packages from there.
Indeed Samba evolves much faster than Debian releases are released, so 
sticking to the primary release is not a good thing in this particular case.

- Kees.

30.03.2023 10:33, Kees van Vloten via samba ?????:
> To add to this, if you do not want everything from backports then use
apt-pinning so that you just get the Samba packages from there.
Please don't do this. There's no need to use pinning with debian
backports.
This is not related to samba but to the way how debian backports archive
works.  The whole thing is marked with

  NotAutomatic: yes
  ButAutomaticUpgrades: yes

so only packages you explicitly ask for are installed from bpo, and these
packages will be kept up to date.  See man 5 apt_preferences.  This is
the way it works since debian squeeze.
> Indeed Samba evolves much faster than Debian releases are released, so
sticking to the primary release is not a good thing in this particular case.
It is not the case here either.

The prob was that 4.13 packages in debian needed quite a bit of adjustments, -
for a few years many changes in there were made in quick but unthinkful way,
making smallest changes instead of right changes. Without updates to new
versions too, - for example, at the time of bullseye, more recent samba
version has already been available (if not two).  The state of samba package
has been, well, not excellent :) - which resulted in minor change in an
unrelated place breaking some other random place. We had a bullseye security
update which resulted in i386 smbd binary crashing at startup due to wrong
order of object files at the link line, - this is obviously completely
unacceptable..

Well.. actually I _can_ try to backport a few security patches from current
samba releases to 4.13, but there are at least 2 issues with that. First,
I really dislike doing that, every time I look at the 4.13 packages I'm
trembling somewhere deep inside :). And second, I tried to backport the
already mentioned Win 22H2 AD-DC fix, provided the updated packages, but
wasn't entirely sure it actually fixes the issue (since I had no environment
to test it), -- see #1022574. But the user in question already switched
to bpo version so even they weren't able to test it for me :) so it went
this way without fixing.

So I'm talking just about this 4.13 debian bullseye thing, not general
debian "vs" samba thing.

I keep samba backports in debian up to date due to this very reason, -
because 4.13 bullseye packages aren't the best.

(I uploaded 4.17.7 (and 4.16.10) versions to debian and to my archives
built for debian and ubuntu, filed an unblock request for bookworm for 4.17.7,
hopefully it will be in bookworm in a few days, and plan to upload it to
bpo11 today or tomorrow).

/mjt