netatalk

netatalk.io

Netatalk 4.6.0 is available!

Today we’re releasing Netatalk 4.6.0, the fastest and most capable AFP server we’ve ever shipped; Netatalk Client 1.0, our client’s first production release; and a rebuilt netatalk.io, the new home for both.

Apple is withdrawing AFP support in macOS Golden Gate. That ends an era, but not the protocol: millions of Macs and NAS devices, decades of archives, studios, labs, and retro-computing setups speak AFP every day. Our answer is to advance. This cycle modernized, hardened, and accelerated the whole stack, and for the first time Netatalk provides both sides of the connection. The server has long run almost anywhere, but mounting AFP was effectively Apple-only. With Netatalk Client 1.0 that constraint is gone: Linux, FreeBSD, NetBSD, OpenBSD, macOS, and illumos/Solaris can now all mount AFP volumes natively. AFP support isn’t just surviving Apple’s retreat — it is reaching more platforms than it ever has.

A file server rebuilt for speed

The network transport now negotiates transfer sizes as the AFP specification intends and aligns every frame to the network path and disk, so bulk transfers stream at full quantum with no wasted packets or buffers. The directory cache defaults to adaptive replacement (ARC) for 10–50% better hit ratios and now caches state, metadata, and resource-fork data, so browsing classic Mac content doesn’t touch the disk once cached. Hot paths were profiled syscall by syscall to strip redundant lookups and path walks, and background cache maintenance is now lock-free, ending latency spikes on busy and single-core systems.

The numbers: benchmarked with the project’s lantest tooling, each release in its stock configuration, 4.6.0 completes the full test set ~55% faster than 4.4.1 and ~45% faster than 4.5.1, and is 200–300% faster on the operations used most — 2.9× on bulk deletes, 2.7× on directory enumeration, 2.3× on file creation and server-side copies. All of it is on by default; every knob remains for specialists.

Strictly coherent caching, correct locking

The caching layers are now strictly coherent: every entry is validated, cross-process changes propagate immediately, and structural defects in the directory cache — some twenty years old — were found by a purpose-built attack test suite and fixed. Locking and delete semantics now match POSIX, macOS, and Samba: files viewed over AFP no longer wedge as “in use”, open forks behave like opens everywhere else, and byte-range locks land where other filesystems put them.

Netatalk alongside other accessors (Samba, NFS, etc)

That work unblocked the headline feature: Netatalk now shares volumes correctly with other protocols. What used to take several coordinated, easily mis-set options is now one switch — declare a volume multi-protocol and every coherency and locking default snaps to the safe value, whether the other accessor is Samba, NFS, or a local process; leave it off and a Netatalk-only server keeps the fast path. Option names match Samba’s, configuration parsing fails closed, and an end-to-end interoperability test — a kernel CIFS mount and a Netatalk Client mount on one shared volume — guards it in CI.

Spotlight search, feature complete

Finder search over AFP now just works: multi-word searches match every word, quoted phrases match exactly, folder-scoped searches stay in the folder, and result limits are honoured — served straight from the CNID database with no external indexer, on every supported platform. Pluggable backends remain for full-text indexing.

Modern database backends

SQLite is now the default catalog backend — zero-configuration and in-process — with MySQL/MariaDB for large or multi-server deployments. Both now distinguish contention, disk-full, and corruption instead of ending user sessions, and even 32-bit ID exhaustion recovers cleanly. The legacy Berkeley DB (dbd) scheme is deprecated and will be removed.

Security and resilience

This cycle closed more than twenty CVEs, hardened every authentication method (DHX, DHX2, SRP), and tightened wire-format parsing throughout. Even the classic AppleTalk transport was modernised — and gained its first unit tests. Every change is now gated by a continuous performance dashboard, a shaped-network test harness, thread-sanitised protocol suites, and JUnit-reported specification tests.

All users of previous Netatalk versions are encouraged to upgrade to 4.6.0.

Breaking changes

SRP UAM hardening

The local verifiers for the Secure Remote Password UAM are now stored in a new format: individual UID files instead of a monolithic flat file. This enables afppasswd to run without elevated privileges. Before existing users can authenticate with SRP after upgrading, you have to migrate the verifiers. Do this by stopping netatalk, then running the following command:

sudo afppasswd -m

See the Upgrading chapter in the manual for more information.

Randnum UAM hardening

Since afppasswd no longer runs with elevated privileges, only root can update passwords for Randnum users. F.e. to reset the password for existing Randnum user alice:

sudo afppasswd -r -a alice

Randnum is still an insecure authentication method, only recommended for deployments with very old Mac clients.

FCE notification script

The fce_ev_script.sh Filesystem Change Events notification sample script distributed with Netatalk for a long time has been improved and renamed to fce_ev_script. It is now installed installed by the build system into libexec with its own man page. Therefore you can now use it out of the box for sophisticated FCE logging, for instance if your install prefix is /usr/local:

[Global]
fce notify script = /usr/local/libexec/netatalk/fce_ev_script
fce version = 2
fce events = fmod,fdel,ddel,fcre,dcre,fmov,dmov,login,logout

Defaults and fallbacks

SQLite (sqlite) is the new default CNID backend, replacing the Database Daemon (dbd).

When the Extended Attributes check fail, we fall back to the AppleDouble v2 metadata backend rather than none.

ARC cache is now the default, rather than LRU.

The afp read locks has been renamed to strict locking. New option multi protocol enables this and other interoperability settings. See the afp.conf man page for more information.

nad capabilities

The nad utility can now decode and encode MacBinary, BinHex, and StuffIt archives.

It can also now operate on non-AFP paths if you append the -f argument to the command.

Installation

netatalk-4.6.0.tar.xz is the Netatalk source distribution. See INSTALL for required dependencies, then build with:

# Extract the source
tar -xf netatalk-4.6.0.tar.xz
cd netatalk-4.6.0

# Configure and build
meson setup build
meson compile -C build

# Install
sudo meson install -C build

netatalk-4.6.0.wbm.gz is the Webmin module tarball. To install the module:

# Adjust the path to match your Webmin installation
/usr/share/webmin/install-module.pl netatalk-4.6.0.wbm.gz

What’s Changed

New Contributors

Full Changelog: https://github.com/Netatalk/netatalk/compare/netatalk-4-5-0…netatalk-4-6-0

Downloads

Footnotes

Release published on 2026-09-15

Generated from GitHub Release Notes