Defaults for xenial (samba 4.3.11):
client min protocol = CORE
client max protocol = default (which is NT1 in this version of samba)
Defaults for artful (samba 4.6.7):
client min protocol = CORE
client max protocol = default (which is NT1 in this version of samba)
Defaults for bionic (samba 4.7.6):
client min protocol = CORE
client max protocol = default (which is SMB3_11 in this version of samba)
So before bionic, if you wanted a more secure protocol, you had to specify it (like smbclient's -m SMB3 option).
Now in bionic, if you want a *less* secure protocol. you have to specify it.
Ideally, computer browsing and actually connecting to shares should happen with different protocol versions.
smbclient in bionic does a quick downgrade to NT1 when needed. Notice the "Reconnecting" message intertwined in the output below:
ubuntu@bionic-desktop:~$ smbclient -L xenial -N -m SMB3
Anonymous login successful
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
public Disk Public share
IPC$ IPC IPC Service (xenial-desktop server (Samba, Ubuntu))
Reconnecting with SMB1 for workgroup listing.
Anonymous login successful
Server Comment
--------- -------
Workgroup Master
--------- -------
UBUNTU XENIAL
In artful, that downgrade does not happen, and we don't get the workgroup listing:
ubuntu@artful-desktop:~$ smbclient -L xenial -N -m SMB3
Anonymous login successful
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
public Disk Public share
IPC$ IPC IPC Service (xenial-desktop server (Samba, Ubuntu))
Anonymous login successful
I suspect smbtree does the same. In bionic, where max protocol is SMB3_11 by default, it works out of the box. But in artful, if I set client max protocol to SMB3_11, it stops working:
ubuntu@artful-desktop:~$ testparm -s -v 2>/dev/null|grep "client max protocol"
client max protocol = default
ubuntu@artful-desktop:~$ smbtree
UBUNTU
\\XENIAL xenial-desktop server (Samba, Ubuntu)
\\XENIAL\IPC$ IPC Service (xenial-desktop server (Samba, Ubuntu))
\\XENIAL\public Public share
\\XENIAL\print$ Printer Drivers
\\BIONIC bionic-desktop server (Samba, Ubuntu)
\\BIONIC\IPC$ IPC Service (bionic-desktop server (Samba, Ubuntu))
\\BIONIC\public Public share
\\BIONIC\print$ Printer Drivers
\\ARTFUL artful-desktop server (Samba, Ubuntu)
\\ARTFUL\IPC$ IPC Service (artful-desktop server (Samba, Ubuntu))
\\ARTFUL\public Public share
\\ARTFUL\print$ Printer Drivers
ubuntu@artful-desktop:~$ sudo vi /etc/samba/smb.conf
ubuntu@artful-desktop:~$ testparm -s -v 2>/dev/null|grep "client max protocol"
client max protocol = SMB3
ubuntu@artful-desktop:~$ smbtree
ubuntu@artful-desktop:~$
So in summay, bionic samba's own tools seem to know when NT1 is needed and downgrade appropriately. Ideally the rest of the smb ecosystem should do the same, assuming there is no way to get the computer listing with non-NT1 protocols.
Defaults for xenial (samba 4.3.11):
client min protocol = CORE
client max protocol = default (which is NT1 in this version of samba)
Defaults for artful (samba 4.6.7):
client min protocol = CORE
client max protocol = default (which is NT1 in this version of samba)
Defaults for bionic (samba 4.7.6):
client min protocol = CORE
client max protocol = default (which is SMB3_11 in this version of samba)
So before bionic, if you wanted a more secure protocol, you had to specify it (like smbclient's -m SMB3 option).
Now in bionic, if you want a *less* secure protocol. you have to specify it.
Ideally, computer browsing and actually connecting to shares should happen with different protocol versions.
smbclient in bionic does a quick downgrade to NT1 when needed. Notice the "Reconnecting" message intertwined in the output below: bionic- desktop: ~$ smbclient -L xenial -N -m SMB3
ubuntu@
Anonymous login successful
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
public Disk Public share
IPC$ IPC IPC Service (xenial-desktop server (Samba, Ubuntu))
Reconnecting with SMB1 for workgroup listing.
Anonymous login successful
Server Comment
--------- -------
Workgroup Master
--------- -------
UBUNTU XENIAL
In artful, that downgrade does not happen, and we don't get the workgroup listing: artful- desktop: ~$ smbclient -L xenial -N -m SMB3
ubuntu@
Anonymous login successful
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
public Disk Public share
IPC$ IPC IPC Service (xenial-desktop server (Samba, Ubuntu))
Anonymous login successful
Server Comment
--------- -------
Workgroup Master artful- desktop: ~$
--------- -------
ubuntu@
I suspect smbtree does the same. In bionic, where max protocol is SMB3_11 by default, it works out of the box. But in artful, if I set client max protocol to SMB3_11, it stops working: artful- desktop: ~$ testparm -s -v 2>/dev/null|grep "client max protocol" artful- desktop: ~$ smbtree artful- desktop: ~$ sudo vi /etc/samba/smb.conf artful- desktop: ~$ testparm -s -v 2>/dev/null|grep "client max protocol" artful- desktop: ~$ smbtree artful- desktop: ~$
ubuntu@
client max protocol = default
ubuntu@
UBUNTU
\\XENIAL xenial-desktop server (Samba, Ubuntu)
\\XENIAL\IPC$ IPC Service (xenial-desktop server (Samba, Ubuntu))
\\XENIAL\public Public share
\\XENIAL\print$ Printer Drivers
\\BIONIC bionic-desktop server (Samba, Ubuntu)
\\BIONIC\IPC$ IPC Service (bionic-desktop server (Samba, Ubuntu))
\\BIONIC\public Public share
\\BIONIC\print$ Printer Drivers
\\ARTFUL artful-desktop server (Samba, Ubuntu)
\\ARTFUL\IPC$ IPC Service (artful-desktop server (Samba, Ubuntu))
\\ARTFUL\public Public share
\\ARTFUL\print$ Printer Drivers
ubuntu@
ubuntu@
client max protocol = SMB3
ubuntu@
ubuntu@
So in summay, bionic samba's own tools seem to know when NT1 is needed and downgrade appropriately. Ideally the rest of the smb ecosystem should do the same, assuming there is no way to get the computer listing with non-NT1 protocols.