Comment 14 for bug 1767454

Revision history for this message
Andreas Hasenack (ahasenack) wrote :

Defaults for xenial (samba 4.3.11):
  client min protocol = CORE
  client max protocol = default (which is NT1 in this version of samba)

Defaults for artful (samba 4.6.7):
  client min protocol = CORE
  client max protocol = default (which is NT1 in this version of samba)

Defaults for bionic (samba 4.7.6):
  client min protocol = CORE
  client max protocol = default (which is SMB3_11 in this version of samba)

So before bionic, if you wanted a more secure protocol, you had to specify it (like smbclient's -m SMB3 option).

Now in bionic, if you want a *less* secure protocol. you have to specify it.

Ideally, computer browsing and actually connecting to shares should happen with different protocol versions.

smbclient in bionic does a quick downgrade to NT1 when needed. Notice the "Reconnecting" message intertwined in the output below:
ubuntu@bionic-desktop:~$ smbclient -L xenial -N -m SMB3
Anonymous login successful

 Sharename Type Comment
 --------- ---- -------
 print$ Disk Printer Drivers
 public Disk Public share
 IPC$ IPC IPC Service (xenial-desktop server (Samba, Ubuntu))
Reconnecting with SMB1 for workgroup listing.
Anonymous login successful

 Server Comment
 --------- -------

 Workgroup Master
 --------- -------
 UBUNTU XENIAL

In artful, that downgrade does not happen, and we don't get the workgroup listing:
ubuntu@artful-desktop:~$ smbclient -L xenial -N -m SMB3
Anonymous login successful

 Sharename Type Comment
 --------- ---- -------
 print$ Disk Printer Drivers
 public Disk Public share
 IPC$ IPC IPC Service (xenial-desktop server (Samba, Ubuntu))
Anonymous login successful

 Server Comment
 --------- -------

 Workgroup Master
 --------- -------
ubuntu@artful-desktop:~$

I suspect smbtree does the same. In bionic, where max protocol is SMB3_11 by default, it works out of the box. But in artful, if I set client max protocol to SMB3_11, it stops working:
ubuntu@artful-desktop:~$ testparm -s -v 2>/dev/null|grep "client max protocol"
 client max protocol = default
ubuntu@artful-desktop:~$ smbtree
UBUNTU
 \\XENIAL xenial-desktop server (Samba, Ubuntu)
  \\XENIAL\IPC$ IPC Service (xenial-desktop server (Samba, Ubuntu))
  \\XENIAL\public Public share
  \\XENIAL\print$ Printer Drivers
 \\BIONIC bionic-desktop server (Samba, Ubuntu)
  \\BIONIC\IPC$ IPC Service (bionic-desktop server (Samba, Ubuntu))
  \\BIONIC\public Public share
  \\BIONIC\print$ Printer Drivers
 \\ARTFUL artful-desktop server (Samba, Ubuntu)
  \\ARTFUL\IPC$ IPC Service (artful-desktop server (Samba, Ubuntu))
  \\ARTFUL\public Public share
  \\ARTFUL\print$ Printer Drivers
ubuntu@artful-desktop:~$ sudo vi /etc/samba/smb.conf
ubuntu@artful-desktop:~$ testparm -s -v 2>/dev/null|grep "client max protocol"
 client max protocol = SMB3
ubuntu@artful-desktop:~$ smbtree
ubuntu@artful-desktop:~$

So in summay, bionic samba's own tools seem to know when NT1 is needed and downgrade appropriately. Ideally the rest of the smb ecosystem should do the same, assuming there is no way to get the computer listing with non-NT1 protocols.