disable smb1 by default

[Seth Arnold]

Hello,

Ned Pyle from the SMB team at Microsoft would very much like us to disable SMBv1 in Samba by default:

https://twitter.com/NerdPyle/status/874798165429440512
https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1/

It'd be nice to make this change early enough that 18.04 LTS does not ship with SMB1 support enabled by default.

Thanks

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Andreas Hasenack (ahasenack)]

List of protocols from the smb.conf(5) manpage. Looks like "NT1" is SMB1:

       client max protocol (G)

           The value of the parameter (a string) is the highest protocol level that will be supported by the client.

           Possible values are :

           · CORE: Earliest version. No concept of user names.

           · COREPLUS: Slight improvements on CORE for efficiency.

           · LANMAN1: First modern version of the protocol. Long filename support.

           · LANMAN2: Updates to Lanman1 protocol.

           · NT1: Current up to date version of the protocol. Used by Windows NT. Known as CIFS.

           · SMB2: Re-implementation of the SMB protocol. Used by Windows Vista and later versions of Windows. SMB2 has sub protocols available.

               · SMB2_02: The earliest SMB2 version.

               · SMB2_10: Windows 7 SMB2 version.

               · SMB2_22: Early Windows 8 SMB2 version.

               · SMB2_24: Windows 8 beta SMB2 version.

           By default SMB2 selects the SMB2_10 variant.

       · SMB3: The same as SMB2. Used by Windows 8. SMB3 has sub protocols available.

           · SMB3_00: Windows 8 SMB3 version. (mostly the same as SMB2_24)

           · SMB3_02: Windows 8.1 SMB3 version.

           · SMB3_10: early Windows 10 technical preview SMB3 version.

           · SMB3_11: Windows 10 technical preview SMB3 version (maybe final).

[Andreas Hasenack (ahasenack)]

This will require some discussion and thought about the implications. I created a trello card in the ubuntu server board trying to scope these out: https://trello.com/c/P73Okl8z

Might need a spec of its own.

[Tyler Hicks (tyhicks)]

I think this is the option that you want to use to restrict the server to a minimum protocol version:

 https://www.samba.org/samba/docs/man/manpages-3/smb.conf.5.html#SERVERMINPROTOCOL

To fix this bug, the value would need to be "SMB2".

[Morbius1 (morbius1)]

Just a side note folks but there's two SMBv1's involved here and both are mentioned in this bug report.

There's the server part ( server min protocol ).

But there is also a samba client part ( client min / max protocol ) and that's where the fun starts.

Nautilus uses gvfs which uses libsmblient to "discover" samba servers on the network. The client max protocol is net to NT1 ( SMB1 ) for a reason. Set "client max protocol = SMB3" or "client min protocol = SMB2" and that discovery is broken. You can still access a host by name but you have to know it's name.

You can verify that yourselves by using the command smbtree. Run it and you will get a list of your hosts and their shares. Change the client min or max values to something other than NT1 and smbtree results in nothing.

[Andreas Hasenack (ahasenack)]

RFC from ubuntu-devel: https://lists.ubuntu.com/archives/ubuntu-devel/2017-June/039820.html

[Stefan Metzmacher (metze)]

Am 19.06.2017 um 15:47 schrieb Andreas Hasenack:
> https://lists.ubuntu.com/archives/ubuntu-
> devel/2017-June/039820.html

You should use "SMB2_02" instead of "SMB2" to also include
that. "SMB2" is an alias for "SMB2_10".

Also remember that old linux clients may also have problems
connecting to an SMB2 only server.

metze

[Andreas Hasenack (ahasenack)]

We are closely watching upstream as they move away from SMB1 by default.

[Julian Alarcon (julian-alarcon)]

Hi!

Adding information to this bug, latest kernel release, 4.13, disabled by default SMBv1:
https://lkml.org/lkml/2017/9/3/155

This is related to SAMBA but still there is work needed
#######
The change in question is simply changing the default cifs behavior:
instead of defaulting to SMB 1.0 (which you really should not use:
just google for "stop using SMB1" or similar), the default cifs mount
now defaults to a rather more modern SMB 3.0.

Now, because you shouldn't have been using SMB1 anyway, this shouldn't
affect anybody. But guess what? It almost certainly does affect some
people, because they blithely continued using SMB1 without really
thinking about it.

And you certainly _can_ continue to use SMB1, but due to the default
change, now you need to be *aware* of it. You may need to add an
explicit "vers=1.0" to your mount options in /etc/fstab or similar if
you *really* want SMB1.

But if the new default of 3.0 doesn't work (because you still use a
pterodactyl as a windshield wiper), before you go all the way back to
the bad old days and use that "vers=1.0", you might want to try
"vers=2.1". Because let's face it, SMB1 is just bad, bad, bad.
#######

[Julian Alarcon (julian-alarcon)]

Adding more info, next future SAMBA version 4.7 will increase the SMB "client max protocol" to SMB3_11 to be able to connect to servers with SMB1 disabled, "client min protocol" is still SMB1.

https://download.samba.org/pub/samba/rc/samba-4.7.0rc1.WHATSNEW.txt
https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.7
https://wiki.samba.org/index.php/Samba_4.7_Features_added/changed

######
The default for "client max protocol" has changed to "SMB3_11",
which means that smbclient (and related commands) will work against
servers without SMB1 support.

It's possible to use the '-m/--max-protocol' option to overwrite
the "client max protocol" option temporary.

Note that the '-e/--encrypt' option also works with most SMB3 servers
(e.g. Windows >= 2012 and Samba >= 4.0.0), so the SMB1 unix extensions
are not required for encryption.

The change to SMB3_11 as default also means smbclient no longer
negotiates SMB1 unix extensions by default, when talking to a Samba server with
"unix extensions = yes". As a result some commands are not available, e.g.
posix_encrypt, posix_open, posix_mkdir, posix_rmdir, posix_unlink, posix_whoami,
getfacl and symlink. Using "-mNT1" reenabled them, if the server supports SMB1.

Note the default ("CORE") for "client min protocol" hasn't changed,
so it's still possible to connect to SMB1-only servers by default.
######

[FR. Loïc (hackurx)]

Hi,

It would be good to take into account the comments from here (I posted a patch that I hope will be used.) :
https://bugs.launchpad.net/ubuntu/+source/samba4/+bug/1736940

The last versions of Windows 10 does not work well with the samba of Ubuntu 16.04 because of the SMB version.

To make it simple with windows 10 1809, I can only run WPKG-GP with SMB v1 !
https://github.com/sonicnkt/wpkg-gp/issues/2

Thanks.

[Sitsofe Wheeler (sitsofe)]

Samba 4.11 (which looks like it will be in 20.04) now defaults the min protocol to SMB2_02 (https://www.samba.org/samba/history/samba-4.11.0.html )...

[Andreas Hasenack (ahasenack)]

Correct, closing the bug.