1

Upon running sudo apt upgrade, I was notified that the package maintainer for Samba has provided a new config file, the difference I noticed was the new commented out wins support and obviously didn't include my specified settings. I reverted back to the old one because my settings were necessary, but I can add them to the new file if it's important, such as security purposes. In general (not just this situation so I'm prepared next time) why would the maintainer push out a new config file and in what situations should I use the new one?

3 Answers 3

2

Every version of the Samba package will contain the configuration file, because the package needs to be useful for initial installations too, not just for upgrades.

But dpkg, the low-level package management tool for apt, is smart enough to record the hashes of any packaged configuration files. It knows what the hash of the original installed version of the configuration file was, so it knows if you have made changes to it after installing the package or not.

If the current configuration file is unchanged from the old packaged version, then dpkg will automatically replace it with a version from a newer package whenever the package is updated, with no questions asked. If the hash of the new packaged version is the same as of the old packaged version, then dpkg knows the packaged configuration file has not been changed between package versions and your customized version should still work with the new version of the package, no questions asked.

But if you have made changes to the configuration file and the configuration file in the new package has a different hash than the one recorded from the originally installed configuration file, then dpkg will prompt you what to do about the file, so your customizations won't be removed without your knowledge and authorization.

Note that the prompt includes an option to show the differences between the versions: if you are uncertain as to what to do, you should first do that to see what has been changed. If everything you see are just your own customizations and some new commented-out settings, then you can keep using the old file, just without the minor benefit of having the commented-out new settings available to you as examples.

But if you see major changes to the structure of the file, you should go read the change log of the package, or the release notes of the new OS release if you are doing a major upgrade, and be aware that you might need to redo your customizations in a way that is compatible with the new version. Obviously, this should not happen within a single release of the operating system, unless the old software version had such fatal bugs that the distribution had no option to backport the fixes, but had to make a major update to that software package in mid-release. Fortunately, such events are quite rare.


With Samba, the most relevant long-term change is the accelerated deprecation of the SMB protocol version 1 and NetBIOS following the WannaCry worm and the related exploits. Since the security experts' attitude to SMBv1 is now "kill it with fire", it is expected that new versions of Samba will make SMBv1 and NetBIOS not enabled unless very deliberately configured, or even outright remove support for them.

As a side effect of the removal of the old NetBIOS services, Samba servers in non-Active Directory environments will become non-browseable: you will still be able to contact Samba shares if you know the name of the computer and share you wish to connect to, but you won't be able to find them in a list of computers on a network. This can be remedied by adding an alternative browsing solution based on the WS-Discover protocol: as far as I know, this is not integrated into Samba yet, but implementations are available with names like wsdd or wsdd2.

1

Software changes, security practices change, so new configs might be more "secure". It's really up to you to decide. There's no general rule of thumb here.

And then (it's quite rare nowadays, but often happened in the past) major new releases of software sometimes have entirely different configuration [files], so using the old one is not possible due to conflicting/obsolete directives.

0

When some package manager warns regarding possible changes in some configuration file it means that you are strongly invited to review the changes. (manually or via some utility offered by your package manager) In no case you should blindly accept the changes, especially if you know that you have customized the configuration file for previous versions.

Changes are most often minor. And, if you had customized the configuration file previously, it will be necessary and just easy to patch a diff on the new configuration file.

But it can happen that important changes have been made, rendering old configuration either obsolete or inappropriate.
If it concerns renowned packages, chances are high that you can find some changelog somewhere. Then first read and understand the changelog and modify the new config file appropriately.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.