2

I've decided to switch to the higher version of SMB in Samba (at least 2) - mostly because of the security reasons.

I've tried to add to the smb.conf in the [global] section:

client min protocol = SMB2
client max protocol = SMB3
server min protocol = SMB2

or just

protocol=SMB2

I have restarted samba or the whole server after each try. But logs say:

[1970/01/01 01:01:12.085949,  0] smbd/negprot.c:706(reply_negprot)


No protocol supported !
[1970/01/01 01:01:13.153024,  0] smbd/negprot.c:706(reply_negprot)
  No protocol supported !
[2018/11/04 12:10:25.080148,  0] param/loadparm.c:7997(lp_do_parameter)
  Ignoring unknown parameter "server min protocol"
[2018/11/04 12:10:25.092055,  0] param/loadparm.c:7997(lp_do_parameter)
  Ignoring unknown parameter "client min protocol"
[2018/11/04 12:10:30.803144,  0] param/loadparm.c:7997(lp_do_parameter)
  Ignoring unknown parameter "server min protocol"
[2018/11/04 12:10:30.804260,  0] param/loadparm.c:7997(lp_do_parameter)
  Ignoring unknown parameter "client min protocol"

I've googled a little and noticed that some people configure cufs also in the FSTAB. I think I had not done this and it was working just becasue of smb.conf.
Here is my FSTAB:

roc            /proc           proc    defaults          0       0
/dev/mmcblk0p1  /boot           vfat    defaults          0       2
/dev/mmcblk0p2  /               ext4    defaults,noatime  0       1
UUID=34150b89-5e8b-4769-8b68-f403659c58f7       /media/USBHD           auto    defaults,_netdev  0       2

And here is the smb.conf part defining the shared folder:

[USBHD]
comment=Dysk udostepniony
path = /media/USBHD
valid users = @users
force group = users
create mask = 0777
directory mask = 0777
read only = no
writeable = yes
browseable = yes
public = yes

Should I edit FSTAB? How?
When is it possible to configure version protocol like in the MAN page in the smb.conf, when it's necessary to do this in FSTAB?
I guess that min protocol may not be available in the Samba version I use. But anyway, it supports SMB2 protocol, so how can I switch it on?

Samba version 3.6.6
NAME="Raspbian GNU/Linux" VERSION_ID="7" VERSION="7 (wheezy)"

Kernel: 4.1.19+

testparm -v

Load smb config files from /etc/samba/smb.conf
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Unknown parameter encountered: "client min protocol"
Ignoring unknown parameter "client min protocol"
Unknown parameter encountered: "client max protocol"
Ignoring unknown parameter "client max protocol"
Processing section "[homes]"
Processing section "[printers]"
Processing section "[print$]"
Processing section "[USBHD]"
Loaded services file OK.
Server role: ROLE_STANDALONE
Press enter to see a dump of your service definitions

[global]
        display charset = LOCALE
        workgroup = WORKGROUP
        realm =
        netbios name = RASPBERRYPI
        netbios aliases =
        netbios scope =
        server string = %h server
        interfaces =
        bind interfaces only = No
        security = USER
        auth methods =
        encrypt passwords = Yes
        client schannel = Auto
        server schannel = Auto
        allow trusted domains = Yes
        map to guest = Bad User
        null passwords = No
        obey pam restrictions = Yes
        password server = *
        smb passwd file = /etc/samba/smbpasswd
        private dir = /etc/samba
        passdb backend = tdbsam
        algorithmic rid base = 1000
        root directory =
        guest account = nobody
        enable privileges = Yes
        pam password change = Yes
        passwd program = /usr/bin/passwd %u
        passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:                                                                                        * %n\n *password\supdated\ssuccessfully* .
        passwd chat debug = No
        passwd chat timeout = 2
        check password script =
        username map =
        password level = 0
        username level = 0
        unix password sync = Yes
        restrict anonymous = 0
        lanman auth = No
        ntlm auth = Yes
        raw NTLMv2 auth = No
        client NTLMv2 auth = Yes
        client lanman auth = No
        client plaintext auth = No
        client use spnego principal = No
        send spnego principal = No
        preload modules =
        dedicated keytab file =
        kerberos method = default
        map untrusted to domain = No
        log level = 2
        syslog = 0
        syslog only = No
        log file = /var/log/samba/log.%m
        max log size = 1000
        debug timestamp = Yes
        debug prefix timestamp = No
        debug hires timestamp = Yes
        debug pid = No
        debug uid = No
        debug class = No
        enable core files = Yes
        smb ports = 445 139
        large readwrite = Yes
        max protocol = SMB2
        min protocol = CORE
        min receivefile size = 0
        read raw = Yes
        write raw = Yes
        disable netbios = No
        reset on zero vc = No
        log writeable files on exit = No
        acl compatibility = auto
        defer sharing violations = Yes
        nt pipe support = Yes
        nt status support = Yes
        announce version = 4.9
        announce as = NT
        max mux = 50
        max xmit = 16644
        name resolve order = lmhosts wins host bcast
        max ttl = 259200
        max wins ttl = 518400
        min wins ttl = 21600
        time server = No
        unix extensions = Yes
        allow dcerpc auth level connect = No
        use spnego = Yes
        client signing = auto
        server signing = No
        client use spnego = Yes
        client ldap sasl wrapping = sign
        enable asu support = No
        svcctl list =
        deadtime = 0
        getwd cache = Yes
        keepalive = 300
        lpq cache time = 30
        max smbd processes = 0
        paranoid server security = Yes
        max disk size = 0
        max open files = 16384
        socket options = TCP_NODELAY
        use mmap = Yes
        hostname lookups = No
        name cache timeout = 660
        ctdbd socket =
        cluster addresses =
        clustering = No
        ctdb timeout = 0
        ctdb locktime warn threshold = 0
        smb2 max read = 65536
        smb2 max write = 65536
        smb2 max trans = 65536
        smb2 max credits = 8192
        load printers = Yes
        printcap cache time = 750
        printcap name =
        cups server =
        cups encrypt = No
        cups connection timeout = 30
        iprint server =
        disable spoolss = No
        addport command =
        enumports command =
        addprinter command =
        deleteprinter command =
        show add printer wizard = Yes
        os2 driver map =
        mangling method = hash2
        mangle prefix = 1
        max stat cache size = 256
        stat cache = Yes
        machine password timeout = 604800
        add user script =
        rename user script =
        delete user script =
        add group script =
        delete group script =
        add user to group script =
        delete user from group script =
        set primary group script =
        add machine script =
        shutdown script =
        abort shutdown script =
        username map script =
        username map cache time = 0
        logon script =
        logon path = \\%N\%U\profile
        logon drive =
        logon home = \\%N\%U
        domain logons = No
        init logon delayed hosts =
        init logon delay = 100
        os level = 20
        lm announce = Auto
        lm interval = 60
        preferred master = No
        local master = Yes
        domain master = Auto
        browse list = Yes
        enhanced browsing = Yes
        dns proxy = No
        wins proxy = No
        wins server =
        wins support = No
        wins hook =
        kernel oplocks = Yes
        lock spin time = 200
        oplock break wait time = 0
        ldap admin dn =
        ldap delete dn = No
        ldap group suffix =
        ldap idmap suffix =
        ldap machine suffix =
        ldap passwd sync = no
        ldap replication sleep = 1000
        ldap suffix =
        ldap ssl = start tls
        ldap ssl ads = No
        ldap deref = auto
        ldap follow referral = Auto
        ldap timeout = 15
        ldap connection timeout = 2
        ldap page size = 1024
        ldap user suffix =
        ldap debug level = 0
        ldap debug threshold = 10
        eventlog list =
        add share command =
        change share command =
        delete share command =
        preload =
        lock directory = /var/run/samba
        state directory = /var/lib/samba
        cache directory = /var/cache/samba
        pid directory = /var/run/samba
        utmp directory =
        wtmp directory =
        utmp = No
        default service =
        message command =
        get quota command =
        set quota command =
        remote announce =
        remote browse sync =
        socket address = 0.0.0.0
        nmbd bind explicit broadcast = Yes
        homedir map = auto.home
        afs username map =
        afs token lifetime = 604800
        log nt token command =
        time offset = 0
        NIS homedir = No
        registry shares = No
        usershare allow guests = Yes
        usershare max shares = 100
        usershare owner only = Yes
        usershare path = /var/lib/samba/usershares
        usershare prefix allow list =
        usershare prefix deny list =
        usershare template share =
        allow insecure wide links = No
        async smb echo handler = No
        multicast dns register = Yes
        panic action = /usr/share/samba/panic-action %d
        perfcount module =
        host msdfs = Yes
        passdb expand explicit = No
        idmap backend = tdb
        idmap cache time = 604800
        idmap negative cache time = 120
        idmap uid =
        idmap gid =
        template homedir = /home/%D/%U
        template shell = /bin/false
        winbind separator = \
        winbind cache time = 300
        winbind reconnect delay = 30
        winbind max clients = 200
        winbind enum users = No
        winbind enum groups = No
        winbind use default domain = No
        winbind trusted domains only = No
        winbind nested groups = Yes
        winbind expand groups = 1
        winbind nss info = template
        winbind refresh tickets = No
        winbind offline logon = No
        winbind normalize names = No
        winbind rpc only = No
        create krb5 conf = Yes
        ncalrpc dir = /var/ncalrpc
        winbind max domain connections = 1
        idmap config * : backend = tdb
        comment =
        path =
        username =
        invalid users =
        valid users =
        admin users =
        read list =
        write list =
        printer admin =
        force user =
        force group =
        read only = Yes
        acl check permissions = Yes
        acl group control = No
        acl map full control = Yes
        create mask = 0744
        force create mode = 00
        security mask = 0777
        force security mode = 00
        directory mask = 0755
        force directory mode = 00
        directory security mask = 0777
        force directory security mode = 00
        force unknown acl user = No
        inherit permissions = No
        inherit acls = No
        inherit owner = No
        guest only = No
        administrative share = No
        guest ok = No
        only user = No
        hosts allow =
        hosts deny =
        allocation roundup size = 1048576
        aio read size = 0
        aio write size = 0
        aio write behind =
        ea support = No
        nt acl support = Yes
        profile acls = No
        map acl inherit = No
        afs share = No
        smb encrypt = auto
        block size = 1024
        change notify = Yes
        directory name cache size = 100
        kernel change notify = Yes
        max connections = 0
        min print space = 0
        strict allocate = No
        strict sync = No
        sync always = No
        use sendfile = No
        write cache size = 0
        max reported print jobs = 0
        max print jobs = 1000
        printable = No
        print notify backchannel = Yes
        print ok = No
        printing = cups
        cups options =
        print command =
        lpq command = %p
        lprm command =
        lppause command =
        lpresume command =
        queuepause command =
        queueresume command =
        printer name =
        use client driver = No
        default devmode = Yes
        force printername = No
        printjob username = %U
        default case = lower
        case sensitive = Auto
        preserve case = Yes
        short preserve case = Yes
        mangling char = ~
        hide dot files = Yes
        hide special files = No
        hide unreadable = No
        hide unwriteable files = No
        delete veto files = No
        veto files =
        hide files =
        veto oplock files =
        map archive = Yes
        map hidden = No
        map system = No
        map readonly = yes
        mangled names = Yes
        store dos attributes = No
        dmapi support = No
        browseable = Yes
        access based share enum = No
        blocking locks = Yes
        csc policy = manual
        fake oplocks = No
        locking = Yes
        oplocks = Yes
        level2 oplocks = Yes
        oplock contention limit = 2
        posix locking = Yes
        strict locking = Auto
        share modes = Yes
        dfree cache time = 0
        dfree command =
        copy =
        preexec =
        preexec close = No
        postexec =
        root preexec =
        root preexec close = No
        root postexec =
        available = Yes
        volume =
        fstype = NTFS
        set directory = No
        wide links = No
        follow symlinks = Yes
        dont descend =
        magic script =
        magic output =
        delete readonly = No
        dos filemode = No
        dos filetimes = Yes
        dos filetime resolution = No
        fake directory create times = No
        vfs objects =
        msdfs root = No
        msdfs proxy =

[homes]
        comment = Home Directories
        valid users = %S
        create mask = 0700
        directory mask = 0700
        browseable = No

[printers]
        comment = All Printers
        path = /var/spool/samba
        create mask = 0700
        printable = Yes
        print ok = Yes
        browseable = No

[print$]
        comment = Printer Drivers
        path = /var/lib/samba/printers

[USBHD]
        comment = Dysk udostepniony
        path = /media/USBHD
        valid users = @users
        force group = users
        read only = No
        create mask = 0777
        directory mask = 0777
        guest ok = Yes
2

2 Answers 2

1

SLES 11.4 is old enough for its Samba to default to SMBv1 only. You've set both client min protocol and client max protocol, which only affect Samba when it's acting as a client, like smbclient.

For server-side, you've only set server min protocol, so the server max protocol is still defaulting to SMBv1. And because now min protocol is higher than max, smbd actually cannot allow any protocol at all.

The facts that SLES 11.4's Samba is so old and its SMBv3 support seems to be buggy (as you discovered) caused us to make it a priority at work to upgrade any Samba servers that were still running SLES 11.4 to SLES 12 or newer.

0

running Samba-3.6.3 in SLES 11.4 which has kernel 3.0, my global section is this and I know SMB2 works because windows 10 client will NOT connect via SMB1 the minimum is SMB2 for win10 out of the box.

Note that if you set Min Protocol = SMB2 then if your clients are Windows 7 it will not work for them... at least i did not figure it out troubleshooting on the windows side I think for Win7 it is default SMB1 unless you manually configure something in win7 to say do SMB2.

And for whatever reason setting max protocol = SMB3 caused things not to work for me thus I have SMB2 specified.

[global]
    min protocol = SMB2
    max protocol = SMB2
    workgroup = workgroup
    passdb backend = tdbsam
    map to guest = Never
    usershare allow guests = No
    add machine script = /usr/sbin/useradd  -c Machine -d /var/lib/nobody -s /bin/false %m$
    domain master = No
    security = user
    wins support = No
    server signing = auto
    name resolve order = lmhosts bcast host
    printing = bsd
    printcap name = /dev/null
    log level = 2 auth:10 auth_audit:3 auth_json_audit:3 winbind:5
    max log size = 1000000

and a sample of a share that i use

[data1]
    create mask = 660
    directory mask = 770
    inherit acls = Yes
    path = /data1
    read only = No

you should not need to do anything in /etc/fstab other than mounting your storage resource as you normally would. Then once mounted make sure access permissions of that folder... chmod 777 /data1 in my example, are open for starters, then when working go ahead and remove world permissions and change group ownership and permissions as you need.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .