2

I checked the whole man mount.cifs and also everything I found related to SMBv3. I have the following scenario:

  • A Ubuntu 16.04 VM in Azure, with kernel 4.12.11.
  • A Azure Files share, with "Secure transfer required" disabled.

The problem I face is that, if I want to use SMBv3, the client will encrypt the transfer anyway, regardless of the setting on server side.

The "Secure transfer required" option, when set to disable, doesn't require encrypted transfer, but it doesn't force un-encrypted transfer. It simply allows the client to decide.

This is the related documentation Azure has: https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-linux

This is the man page on CIFS: https://linux.die.net/man/8/mount.cifs

The question is: Is there any way to disable encryption client side, in Linux, when mounting with mount.cifs using SMBv3?

Later edit:

The reason I want to use SMBv3 is related to the speed in transfer, compared to SMBv2.1. The problem with the encryption is that it goes high on CPU usage. If I use SMBv2.1, the CPU usage is lower, but also the transfer is twice as slow.

  • 1
    I do not think its possible, see kernel documentation in Documentation/filesystems/cifs/README. You can require encryption, but you can't turn it off client side, since there isn't a mount option nor a security flag for disabling encryption. – sebasth Sep 24 '17 at 19:03
  • @sebasth - using standard options I'm sure you are right. Maybe someone has some hack at hand :) – Marin Nedea Sep 25 '17 at 11:42
0

We recently particiated in "client synergy" session during SDC 2017.conference where six different clients were connecting Azure. According to Azure, encryption is always a must. See full session on snia.org

  • I totally agree with you, when it comes to transfer data between regions, from on premises to Azure, etc. But in case I have the VM in the same Resource Group with the Azure Files Share, same Storage Account, same Region, the traffic is between the resources inside Azure. It's "intranet", not "internet". So, encryption becomes pointless. Also, if encryption is a must, why SMBv2.1 is still supported in Azure ? Assuming is a must, why not let the customer decide on the encryption solution? You can handle encryption at various levels, you don't need that forced in the Linux kernel. – Marin Nedea Sep 22 '17 at 15:03
  • To my understanding they only require encryption on an outside connection. Apparently they allow 2.1 for an in-cloud connection. – Mark Rabinovich Nov 28 '17 at 9:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.