PRODUCT:          	Advanced Server for UNIX
--------
UPDATED PRODUCT:	Advanced Server for UNIX Version 5.1B-5
----------------
RELEASE DATE:		November 2008
----------------

The Advanced Server for UNIX (ASU) Version ASU 5.1B-5 kit provides 
enhancements and corrections for problems found in the ASU Version 5.1B-4  
software, including ECO2 and in earlier versions of the ASU software.

The release note document is organized as follows: 

- New Registry, lanman.ini, and transports.ini Parameters
- ASU Command Changes
- ASU General Changes
- ASU Command Problem Descriptions and Solutions
- ASU General Problem Descriptions and Solutions 
- Known Problems 
- ASU Installation Instructions

-------------------------------------------------------
New Registry, lanman.ini, and transports.ini Parameters
-------------------------------------------------------

New Registry Parameter:
A new registry parameter, RequireStrongKey, specifies whether the
ASU server must use a strong (128 bit) session key for encryption
during secure channel operations.
 
Setting RequireStrongKey to 1, specifies that an ASU server must use
a strong (128 bit) session key.  If the domain controller on the
other side of the channel does not support strong (128 bit) session
keys, then the ASU server will refuse to establish a secure channel.
 
The default value is 0.
 
This parameter is located under the following ASU registry key:
 
  SYSTEM/CurrentControlSet/Services/Netlogon/Parameters
 
Note: This registry parameter should be set to 1 only when all
the other domain controllers support strong keys.  Windows 2000 and later
support strong keys.

-------------------
ASU Command Changes
-------------------

Change:
The "listcache" command has a new option, -C, to clear the
name cache statistics. Also, the "listcache -S" command will
now show the time when the statistics was cleared.

Change:
A new command called eautil is available to display and manipulate extended
attributes of objects that are used by OS/2 clients. 
The command may be used to:
- Split the extended attributes to a hold file
- Join the extended attributes from a hold file
- Delete all the extended attributes

This command is modeled after the OS/2 eautil command.

See the eautil reference page for more information about the
eautil command.

Change:
The "lmstat -P" command has been enhanced to display a count of the number of ASU transports each NetBIOS name has been posted on.

Change:
The "lmstat -n" command has been enhanced to display RPC
connection count for each lmx.srv process.

Change:
A new command called convea is available to convert extended
attribute files that were originally created by OS/2 clients on a PATHWORKS for OpenVMS server, and copied to a Tru64 UNIX system without using ASU.  This command may also be used to list the contents of extended attribute
files from an OpenVMS system without converting the files.

See the convea reference page for more information about the
convea command.

---------------
General Changes
---------------

Change:
If ASU SIA was installed from a debug ASU kit, debugging information was
written to /usr/net/servers/lanman/tmp/libasusia.log file. Now ASU SIA
debugging information is written to standard debug logs in the
/usr/net/servers/lanman/debug directory, when the lanman.ini parameter
[lmxserver]debug is set to the value "yes".

Change:
The knblink debug log will now display the file and the line number
of the source code that generated each debug log entry.

Change:
The lmx.srv process now has a new task called PwdUpdate, which exclusively
processes UNIX password changes.  This task is created only if
the SyncUnixPassword registry parameter is enabled.  The state of this task
can be displayed with the "lmstat -t" command.

Change:
The parameter [tcpip]listenallaliases in transports.ini file is now
obsolete.  The ASU server ignores any value set for this
parameter, and behaves like the value was set to "yes"
(accept connections to any IP address).

Change:
If the ASU server received a datagram that was too short, the
knblink process logged an unusual event. The ASU server discarded short datagrams. This was a common issue which did not cause any known problems.
Hence, the knblink process no longer logs an unusual event on receiving a short datagram.

Change:
The ASU server no longer lists the "permanent name" in the
list of posted NetBIOS names that are displayed by the
Windows "nbtstat -a" command, or the ASU "nbstatus" command. 
(The permanent name is ten null characters, followed by the
six-character MAC address in binary.) In addition, ASU now
returns zeroes for the TCP/IP adapter statistics (except for
the MAC address) displayed by the ASU "nbstatus" command.

These changes make ASU consistent in behavior with Windows.

Change:
The default value of the rc4encryption parameter in the [netlogon] section
of lanman.ini file, has been changed from "no" to "yes".  The new default value 
of "yes" implies that if a client or server requests RC4 encryption, then ASU
will use RC4 encryption to encrypt password information.  Setting the value
of the parameter to "no" will cause ASU to use DES encryption.

----------------------------------------------
ASU Command Problem Descriptions and Solutions 
----------------------------------------------

Problem Addressed:
If the Primary Domain Controller (PDC) of a domain was changed, and 
the "asusetup" command was run on an ASU member server of that domain, the member 
server's SAM database was not updated to reflect the new PDC. Under 
certain conditions, this prevented the ASU member server's NetLogon 
service from starting properly. This in turn prevented users from 
being able to access resources on the member server using their domain 
accounts.

This problem has been corrected.

Problem Addressed:
If ASU was configured as a member server, and the user executed the
setdomainname command without any command line arguments (that is,
in interactive mode), then the command failed with the following
error message:
 
  ERROR: Creation of remote account failed - Access Denied.
         The account or password is invalid or 'invalid'
         is not an administrative account.
 
This problem has been corrected.

Problem Addressed:
If asusetup command was used to change the role of ASU from a backup domain controller
(BDC) in one domain to the primary domain controller (PDC) of a new domain,
ASU incorrectly retained the local groups from the old domain.
 
This problem has been corrected.

Problem Addressed:
If ASU was configured as a member server, and the user executed the "joindomain"
command, with only the server name changed, then almost all the "net" commands
failed with error 5 or error 1326, even though the server started successfully.
For example:

 # net user

 Error 5 has occurred.
 Access is denied.

 # net view

 Error 1326 has occurred.
 Logon failure: unknown user name or bad password.

This problem has been corrected.

Problem Addressed:
The following commands:

 # net group <group-name> /delete
 # net localgroup <localgroup-name> /delete

used to delete the named group or local group unconditionally, even if the group or
local group still had members.  This potentially resulted in loss of access to
resources, since each group is represented by a unique security identifier (SID),
which is independent of the group name.  As SIDs are never reused, even
creating an identically named group would not restore access to resources which
named the original group in their access control lists (ACLs).

This problem has been corrected. The commands now warn the user that if
a group is deleted, creating an identically named group will not restore access to
resources. Before deleting a group, which has members, the command warns the user and prompts for confirmation. 
 
Problem Addressed:
The "acladm -T" command was not able to trim redundant ACLs
for filenames with a directory path over 993 characters long.

This problem has been corrected.

Problem Addressed:
If asusetup command was used to promote ASU from a backup domain controller (BDC) to
the primary domain controller (PDC) of the same domain, the asusetup command failed
with the error:

    STATUS_INVALID_DOMAIN_ROLE

    ERROR: The administrative password cannot be set.
    Remove this package and any previous installations before reinstalling.

This problem has been corrected. The asusetup command warns the user that the 
Server Manager utility or the promote command must be used to promote a BDC to 
a PDC of the same domain.

asu9-97-vatne
Problem Addressed:
The "lmshell" utility's "net logon" command failed to use
the specified domain name when only the user name and domain name
were specified on the command line.

This problem has been corrected.

Problem Addressed:
If the "net logon" command was unable to validate a user name
and password from a trusted domain, other "net" commands that
require a valid user name and password sometimes failed
with the error "Access is denied.", even though the Trusted
Domain Secure Channel between the ASU server and the trusted
domain was authenticated.

This problem has been corrected.

Problem Addressed:
If the "asusetup" command was used to change the server name of a member
server, and at the same time, the domain name or the primary domain controller
was also changed, then asusetup command exited with the following error:

    Failed to convert the SAM database.
    Please correct the error and re-execute
 
This problem has been corrected.

Problem Addressed:
The 'chacl -o' command would incorrectly set the owner of the file
or directory to "SYSTEM", and the 'chacl -g' command would
incorrectly set the group of the file or directory to NULL.
 
This problem has been corrected.

Problem Addressed:
The "lsacl -l -t" command used to display "(error 87)" for
a NULL group SID.

This problem has been corrected.

Problem Addressed:
If the "net" command prompted the user for a password, the user
could not use the backspace key to erase a mistyped character.
Instead, both the mistyped character and the ASCII delete character
were considered as part of the password, and the command 
usually failed.

This problem has been corrected.

Problem Addressed:
The utilities chacl, chattr, eautil, lsacl, lsattr, rmacl and
rmattr failed to display an error message when the Objectname
was not specified.
 
This problem has been corrected.

Problem Addressed:
Under rare circumstances, the "net session" command 
failed to list all valid sessions.

This problem has been corrected.

----------------------------------------------
ASU General Problem Descriptions and Solutions 
----------------------------------------------

Problem addressed:
In the Security event log, the ASU server sometimes incorrectly swapped
the values of the "Logon Process" and "Authentication Package" fields in the
"Unknown user name or bad password" event (event ID 529). This problem
affected the display of information in the elfread and Event Viewer utilities.

This problem has been corrected.

Problem addressed:
If the SyncUnixPassword registry enry was set to 1 (enabled), and the UNIX
password database contained a large number of entries, then changing an ASU
password excessively delayed other users from logging in or changing their
password.

This problem has been corrected.

Problem addressed:
ASU could not be configured as a member server to a Windows Longhorn PDC.
The "asusetup" utility failed with the following error:

  One or more built-in global groups are not added to built-in local groups
  at member server.
          Failed to convert the SAM database.
          Please correct the error and re-execute

This problem has been corrected.

Problem addressed:
If ASU was configured as a member server to a Windows Longhorn PDC, or was
configured to trust a Windows Longhorn PDC, any attempt to logon to the ASU
server with an account from the Windows Longhorn domain failed with the
error:
 
    Unknown username or bad password.
 
Also, the "lmstat -s" command showed the status of the connection to the
Windows Longhorn PDC as STATUS_ACCESS_DENIED.
 
This problem has been corrected.

Problem addressed:
If the PDC role was moved to a different domain controller in the domain,
an ASU member server lost connectivity to any domain controller
after 10 days.  Event  ID 5719 appeared in the system event log with
the description:
 
 No domain controller is available for domain <domain-name> for the
 following reason:  There are currently no logon servers available to
 service the logon request.
 
where <domain-name> was the name of the domain.
 
This problem has been corrected.  When the NETLOGON service is
restarted on the member server, the new PDC name is updated in
the member server's SAM database, and connectivity is reestablished.

Problem addressed:
Occasionally, the ASU server would not be able to establish a
secure channel to trusted domain controllers.  The "lmstat -s"
command showed the trust status as STATUS_ACCESS_DENIED.
Users would not be able to connect to the ASU server using an
account from the trusted domain.

This problem has been corrected.

Problem addressed:
The OS/2 clients generated event 6329 in the ASU system log file
when attempting to access OS/2 extended attributes for a directory.
The following event log message was generated:

  The extended attribute file (<directory-path>) is corrupt.

where <directory-path> is the full UNIX path of the directory.

The extended attributes file was in fact not corrupt, but the ASU
server would not return the extended attributes to the OS/2 client.

This problem has been corrected.

Problem addressed:
If the number of client sessions to the ASU server reached the maximum 
configured number (by default 410) , a new client connection to 
the ASU server sometimes crashed the lmx.ctrl process.

This problem has been corrected.

--------------
Known Problems 
--------------

Known Problem:
While attempting to join a Windows Vista SP1 workstation to an ASU domain,
the workstation displays the following error message:

  Logon Failure: unknown user name or bad password
 
Known Problem:
While attempting to configure ASU to trust a Windows Server 2008 domain, the following error is obtained at the ASU server side:
Error 5 has occurred.
Access is denied.

To correct this problem make the following changes on the Windows Server 2008: 

   a. From the start menu, click "Run" and enter "regedit".
   b. Select HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
      LanmanServer\Parameters\NullSessionPipes and choose "Modify" from 
      the pulldown menu.
   c. In the "Edit Multi-String" window, add the entry, "lsarpc" to the
      value data field and select OK.

Known Problem:
If ASU was configured as a member server to a Windows Longhorn PDC, or
was configured to trust a Windows Longhorn PDC, any attempt to set the
permission for a resource on the ASU server with an account from the
Windows Server 2008 domain, failed with an error:

  One or more user or group names were not found.
  More help is available by typing NET HELPMSG 6427.

Known Problem:
If permissions were set for a resource on the ASU server to grant a user or group account from a Windows Server domain privileges, and if this
Windows Server domain was migrated to a Windows Server 2008 domain after the setting of permissions, any attempt to enumerate the permissions for that resource would give a hex number instead of the name of the user or group account: 

For Example:
# net perms \\<share>
Resource:    \<share>
Owner:
Name:                               Permissions:
----------------------------------------------------------------------
<domain>\0000603d                   FullControl(All)
<domain>\000065a3                   FullControl(All)
<domain>\0000669e                   FullControl(All)

-----------------------------
ASU Installation Instructions
-----------------------------

This software kit includes features and 
functionality of previous ASU software releases, and provides corrections 
for the problems described in this document.

If you are installing the ASU software for the first time, change to the 
directory where the software was downloaded. Enter the following 
command, and follow the instructions on the screen:  

# setld -l .

If you have ASU, ASDU, or PATHWORKS for DIGITAL UNIX subsets installed, 
you must use the Tru64 UNIX setld command to uninstall those subsets 
before you install the subsets in this kit.  

Follow these steps to use the setld command to uninstall ASU, ASDU, or 
PATHWORKS subsets and install the ASU Version 5.1B-5 software:

1. Display the installed ASU, ASDU, or PATHWORKS subsets. 

Enter one of the following commands depending on the software installed: 

# /usr/sbin/setld -i | grep ASU | grep -v not
# /usr/sbin/setld -i | grep ASDU | grep -v not
# /usr/sbin/setld -i | grep PATHWORKS | grep -v not

2. Uninstall the ASU, ASDU, or PATHWORKS subsets.  

Enter the /usr/sbin/setld -d command followed by the name of each 
subset. For example, to deinstall the ASU Version 5.0 base, transport, 
and reference page subsets enter: 

# /usr/sbin/setld -d ASUBASE500 ASUTRAN500 ASUMANPAGE500  

While subsets are being uninstalled, you are prompted to save 
configuration files and the user account and share databases. Save these 
files and databases if you want to reuse them with the ASU 
Version 5.1B-5 software. 

3. Install the ASU Version 5.1B-5 software.

Change to the directory where the ASU Version 5.1B-5 software was 
downloaded, enter the following command, and follow the instructions 
on the screen:  

# setld -l .

See the ASU Installation and Administration guide for more information 
on installing the ASU software.

===============================================================

2008 Hewlett-Packard Development Company, L.P.
Confidential computer software. Valid license from HP required for 
possession, use or copying. Consistent with FAR 12.211 and 12.212, 
Commercial Computer Software, Computer Software Documentation, and 
Technical Data for Commercial Items are licensed to the U.S. Government 
under vendor's standard commercial license.

The information contained herein is subject to change without notice. 
The only warranties for HP products and services are set forth in the express 
warranty statements accompanying such products and services. Nothing herein 
should be construed as constituting an additional warranty. HP shall not be 
liable for technical or editorial errors or omissions contained herein.
 
UNIX is a registered trademark of The Open Group. Microsoft and Windows
are U.S. registered trademarks of Microsoft Corporation.