New CTDB LVS Single-Entry Load Balancing for SMB

Since 4.19.4, the UniVirStor SMB service has supported CTDB Public VIP for high availability: multiple Virtual IPs can be distributed across cluster nodes, and if any node fails, its VIP automatically moves to a healthy node so SMB service continues uninterrupted.

4.19.6 adds a second option — the LVS (Linux Virtual Server) mode built into CTDB, which provides single-entry load balancing. All clients connect to one external address, and CTDB distributes those connections across the nodes in the cluster. Administrators can select the network interface used by the SMB Cluster VIP and complete the LVS configuration from the UVS Manager interface.

The Two Modes Are Mutually Exclusive

CTDB Public VIP and CTDB LVS serve different design goals and carry different constraints. Choose one based on your network architecture and requirements:

Whichever mode you choose, both preserve the no-single-point-of-failure design principle that UniVirStor is built on.

Major Enhancements to Enterprise SMB and Active Directory Access Control

This is the largest area of change in the release. The goal is to make UniVirStor SMB services fit more naturally into an organization's existing Active Directory domain and permission governance model.

Automatic AD UID/GID Synchronization

A new SMB Share Owner setting synchronizes Active Directory UID/GID mappings to the Ceph side, keeping permissions consistent across systems.

Advanced Mask Permission Settings

Share creation and editing now support create mask and directory mask, giving precise control over the default permissions applied to files and folders created through that share — which is what least-privilege security policies require.

Samba User Mapping and Global Configuration in the Web UI

Samba idmap support has been extended, and Global Configuration can now be edited directly from the UVS Manager interface rather than only from the command line. NFS and SMB nobody and nogroup mappings have also been improved, addressing user-mapping problems that arise when the same data is accessed through different protocols.

Session and Open File Management Tools

Administrators can close specific sessions and open files directly from the SMB Status page in UVS Manager, or through smbcli — useful for clearing locked files and stale connections.

For enterprise and government customers who already run an Active Directory domain and need rigorous access governance, this round of work makes UniVirStor considerably easier to fit into an existing identity infrastructure.

New UVS Firewall Manager: Subnet-Based Service Access Control

UVS Firewall Manager, introduced across 4.19.5 and 4.19.6, lets administrators restrict which source subnets may connect to specific services in the cluster, directly from the UVS Manager interface — with no need to maintain firewall rules manually at the operating system level.

This release also completes the default firewall port configuration required by each service, reducing the risk of a service misbehaving at deployment time because a rule was missing. It is a direct answer to governance requirements in government agencies, academic institutions, and enterprise environments with network segmentation compliance obligations.

Enhanced Ceph Core Storage and CephFS Management

More Flexible Bluestore Deployment

The UI now supports configuring Bluestore device sharing, OSD deployment can specify a Bluestore path, and an issue preventing a Bluestore OSD from rejoining the cluster has been fixed.

Adjustable Pool Compression Policy

Compression algorithm and mode can now be set when creating or editing a pool, so capacity efficiency can be tuned to the characteristics of the data.

New Permission Preset Modes for CephFS Subvolumes

Creating and editing subvolumes and subvolume groups now offers permission preset modes: Private (700), Group Collaboration (770), Public (777, for Windows ACL environments), Default (755), and Custom — instead of working through the permission matrix checkbox by checkbox.

New Mount-Free CephFS Command-Line Tool

This release introduces cephfs-cli, a node-side command-line tool that connects to a CephFS volume directly through libcephfs, with no need to establish a kernel mount point first. Previously, operations teams and higher-level services had to mount the filesystem before performing the same actions, which was cumbersome and granted a far broader permission scope than necessary. These capabilities are now exposed as a command-line interface that can be scripted and called by other services.

It covers six areas: directory operations (create, recursive list), file content access (get and put), ownership and permissions (chown and chmod), quota management (set, remove, usage query), extended attributes (xattr list, get, set, delete), and secure deletion. All query commands emit JSON, which makes integration with existing operations scripts and monitoring systems straightforward.

Expanded Management Commands

cephCMD now supports the ceph tell osd command family, along with a --list parameter that shows all hosts regardless of whether services are running on them.

These changes are aimed at day-to-day operational efficiency in large-scale storage clusters — a good fit for AI storage and data center environments that manage substantial capacity and many OSD nodes over time and want those workflows automated.

Improved S3 Object Storage (RGW) Management Experience

Independently Configurable Index Pool

When adding a placement pool to an RGW zone, you can now either reuse an existing index pool or create a new one with a specified CRUSH rule. This makes it possible to place the index pool on NVMe or SSD while the data pool uses HDD, matching storage media to actual workload characteristics.

Simplified Workflows

Opening the RGW page now loads the default site information (realm, zonegroup, zone) automatically, so single-site deployments no longer need to reselect it every time. Buckets created through UVS Manager also appear in the list immediately, without having to switch user type and user first.

Comprehensive Upgrade to Reporting, Monitoring, and Alerting

Redesigned Scheduled Reports

Scheduled reporting has moved from a single configurable report to multiple report jobs, each with its own recipients, report types, and delivery time. Six reporting periods are supported:

Report timestamps follow the local time zone of the UVS host, report contents can be selected item by item, and reports can be exported as PDF. The custom report workflow has been adjusted as well: recipients can be specified, and leaving the field empty falls back to the default notification list.

Report Retention Policy

Each report job keeps only the most recent report file on the UVS host; a newly generated report overwrites the previous file of the same type. Long-term archiving of historical reports should therefore rely on the recipients' mailboxes.

Alert Severity Levels and Delivery Status

UVS Alert Manager now supports alert severity levels, and shows for each event whether an email was triggered and what the outcome was. This helps teams triage by severity, and makes it far easier to answer the question of why a particular alert never arrived.

More Flexible Notifications

Alert emails now support file attachments and their own recipient lists. SMTP notification adds support for servers that do not require username and password authentication, such as an internal mail host on port 25.

Expanded Monitoring Coverage

New Prometheus alerting rules cover Samba container readiness, CTDB node health, and Active Directory connectivity, and include exporter-down detection — so a service stopping entirely no longer results in the silent failure of no alerts at all.

Built-In Grafana Upgraded To 13.1.1

This addresses known security vulnerabilities in the previous version. For enterprise and government customers who produce audit or operations reports on a schedule and have vulnerability management obligations, this round of reporting and alerting work is particularly relevant.

Stability and Security Hardening

This release includes several stability improvements: the management database (Galera Cluster) can now recover automatically after a service interruption, system restore and container redeployment workflows are more robust, and authentication between internal services has been strengthened.

Network Bonding Default Changed To Active-Backup

To achieve load balancing on the receive path, the previous balance-alb mode intercepted and rewrote the source MAC address in ARP replies. This caused a single IP to map to several MAC addresses in the switch FDB, triggering MAC flapping alarms; in severe cases it caused an STP topology change and several seconds of network outage, and in EVPN or VXLAN environments the MAC-IP binding would keep flapping. Switching the default to Active-Backup avoids this class of problem.

Frequently Asked Questions

▾What are the main updates in UniVirStor 4.19.6?

▾What is the difference between CTDB Public VIP and CTDB LVS, and which should I choose?

▾Why do these release notes also cover 4.19.5?

▾What can UVS Firewall Manager do?

▾Which reporting periods are supported, and how long are reports kept?

▾How does the new CephFS command-line tool differ from existing management methods?