Samba 4.25.0rc2 Lands With Experimental SMB3 Persistent Handles and Cluster Overhaul
Samba 4.25.0rc2 just dropped. The second release candidate throws experimental transparent failover support, a fresh cluster functional level system, and a long-overdue Kerberos encryption hardening at you. It's strictly a testing build. Not for production. The machinery here is clearly marching toward a stable 4.25.
RC2 tightens up several bugs caught since the first candidate. DNS handling gets patched for packets over 4KB that need to fall back to TCP, samba-tool zone commands stop throwing internal errors, and EDNS client quirks finally get addressed. The audit logger also sheds some formatting baggage. Leading spaces are gone from JSON output, and embedded newlines convert to spaces so parsers don't choke on malformed objects.
Persistent Handles and the Transparency Trade-off
The headline grab is SMB3 Persistent Handles, which Samba is positioning as the backbone for transparent failover. Client file handles now persist to durable on-disk storage, so a server crash or planned reboot no longer forces applications to restart their file operations from scratch. That matters a lot for VM disk storage and clustered databases where a half-second hiccup can cascade into a full outage. Microsoft's Always-On SMB does something similar, but Samba has to map those guarantees onto its own clustering stack, which explains why the feature stays experimental for this round.
You enable it by setting continuous availability = yes on a share and flipping the global smb3 persistent handles = yes switch. There's a catch, though. Enabling the feature forces SMB-exclusive access on that share. kernel oplocks, kernel share modes, and posix locking all get disabled in the process. If you run POSIX or NFS clients against the same directory, they're out of luck. The sync flushes on every open and close also noticeably spike latency. It's a heavy feature, not something you toggle on casually.
Clustering, Rate Limiting, and DNS
The structural shift is the new cluster functional level. It behaves much like AD domain functional levels, but scoped to the cluster itself. Stored in cluster_level.tdb, it gates new database formats and inter-node protocols behind an explicit upgrade step. Samba 4.25 starts at level 1.0. Mixed-version nodes can coexist during an upgrade window, but once you raise the level, you cannot go back. The net clusterlevel commands handle the heavy lifting.
Alongside that, vfs_aio_ratelimit now coordinates per-share rate limits across the entire cluster. A new ratelimitd daemon collects usage from every smbd process on a node and broadcasts the totals to the rest of the cluster via the messaging layer. Build it with --with-ratelimitd.
On the security side, the KDC now defaults to AES-only encryption for domains at functional level 2008 or higher. That closes out CVE-2026-20833 and stops weaker encryption types from slipping into Kerberos negotiations by default. The deprecated allow dcerpc auth level connect parameter is also gone from smb.conf. CTDB users will notice lock, PID, and socket directories now live under ctdb/ subdirectories of your configured Samba paths. The legacy init detection routines are finally deprecated in favor of CTDB_PLATFORM_STYLE.
Download the tarballs from here and verify them with GnuPG key AA99442FB680B620. The final 4.25 is clearly taking shape, and rc2 gives you a solid window to stress test the new cluster machinery before it hits production.
