Error message CIFS VFS: protocol revalidation - security settings mismatch

Question

Server: Debian 8, Clients: some Windows and some Xubuntu 16.04

Since I updated one Xubuntu Client to 4.13.0-26, I can't mount the samba shares.

[20390.135208] No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3 (or SMB2.1) specify vers=1.0 on mount.
[20390.161744] CIFS VFS: protocol revalidation - security settings mismatch
[20390.162553] CIFS VFS: session ffffa06a57c23a00 has no tcon available for a dfs referral request
[20390.163395] CIFS VFS: cifs_mount failed w/return code = -5

I understand that is has to do with smb-Protokoll, but when I use

testparm -v | grep protocol

on my server it sais:

Load smb config files from /etc/samba/smb.conf
Processing section "[homes]"
Processing section "[profiles]"
Processing section "[netlogon]"
Processing section "[printers]"
Processing section "[print$]"
Processing section "[firmendaten]"
Processing section "[downloads]"

Loaded services file OK.
WARNING: You have some share names that are longer than 12 characters.
These may not be accessible to some older clients.
(Eg. Windows9x, WindowsMe, and smbclient prior to Samba 3.0.)
Server role: ROLE_STANDALONE

Press enter to see a dump of your service definitions

    server max protocol = SMB3
    server min protocol = LANMAN1
    client max protocol = default
    client min protocol = CORE
    client ipc max protocol = default
    client ipc min protocol = default

Here's my smb.conf:

[global]
    workgroup = MYGROUP
    passdb backend = tdbsam
    printing = cups
    printcap name = cups
    printcap cache time = 750
    cups options = raw
    map to guest = Bad User
    logon path = \\%L\profiles\.msprofile
    logon home = \\%L\%U\.9xprofile
    logon drive = P:
    usershare allow guests = Yes
        os level = 20
        netbios name = SERVER
    server string = Linux Server 2013
    domain master = yes
        load printers = yes
        allow insecure wide links = yes
        follow symlinks = yes
        wide links = yes
    unix extensions = no


[homes]
    recycle:touch = Yes
    browseable = No
    writeable = yes
    invalid users = daten
    vfs object = recycle 
    recycle:exclude = *.tmp,*.temp,*.o,*.obj,~$*,*.~??
    recycle:keeptree = Yes
    comment = Home Directories
    valid users = %S,%D%w%S
    recycle:repository = .Papierkorb
    recycle:versions = Yes
    recycle:directory_mode = 0700
    inherit acls = Yes


[profiles]
    comment = Network Profiles Service
    path = %H
    read only = No
    store dos attributes = Yes
    create mask = 0600
    directory mask = 0700


[netlogon]
    comment = Network Logon Service
    path = /var/lib/samba/netlogon


[printers]
    browseable = no
    writeable = yes
    printable = yes
    path = /var/tmp
    create mask = 0700
    comment = Alle Drucker
    public = yes

[print$]
    path = /var/lib/samba/drivers
    write list = root,@ntadmin
    force group = ntadmin
    create mask = 0664
    comment = Printer Drivers
    directory mask = 0775
    valid users = @firma,@privat

[firmendaten]
    write list = @users
    recycle:excludedir = /tmp,/temp,/cache,.Papierkorb
    force directory mode = 0770
    force group = firma
    recycle:keeptree = Yes
    inherit acls = Yes
    recycle:touch = Yes
    vfs objects = recycle
    writeable = yes
    path = /home/files/firma
    preexec = mkdir -p .Papierkorb
    force create mode = 0770
    recycle:exclude = *.tmp,*.temp,*.o,*.obj,~$*,*.~??
    comment = Firmendaten
    valid users = @firma
    create mode = 0770
    recycle:repository = .Papierkorb
    recycle:versions = Yes
    recycle:directory_mode = 0770
    directory mode = 0770

[downloads]
    recycle:excludedir = /tmp,/temp,/cache,.Papierkorb
    write list = @users
    force group = firma
    recycle:keeptree = Yes
    create mask = 0770
    inherit acls = Yes
    recycle:touch = Yes
    vfs objects = recycle
    writable = yes
    path = /home/files/downloads
    preexec = mkdir -p .Papierkorb
    recycle:exclude = *.tmp,*.temp,*.o,*.obj,~$*,*.~??
    directory mask = 0770
    comment = Firmendaten
    recycle:versions = Yes
    recycle:directory_mode = 0770
    recycle:repository = .Papierkorb

As far as I understand does the server have SMB2 and SMB3 support. I tried this addition in

[home]
min protocol = SMB2

respectively

[home]
min protocol = SMB3

Than I can see in server:

server max protocol = SMB3
server min protocol = SMB3

respectively

server max protocol = SMB3
server min protocol = SMB2

But the client still can't mount.

this is the part of the client's fstab:

//192.168.0.251/firmendaten /home/username/server/firmendaten cifs gid=1000,uid=1000,file_mode=0660,dir_mode=0770,user,noauto,credentials=/home/username/.smbcredentials

How can I mount using the secure protocol SMB2 / SMB3?

Thanks in advance!

Answer 1

I found a solution. It works with adding the version at the client mount

//192.168.0.251/firmendaten /home/username/server/firmendaten cifs gid=1000,uid=1000,file_mode=0660,dir_mode=0770,user,noauto,vers=2.1,credentials=/home/username/.smbcredentials

I thought I could do something on the server's smb.conf, but this works,too.