3

Although this is for Xerox Phaser 3635MFP, symptoms may be similar when connecting an old network printer/scanner to a latest version of Samba server.

The scenario is:

  • latest Samba server (4.17.12) is running on Raspberry Pi 5 with Debian Bookworm
  • a Samba share is set up and other Linux and Windows machines on local network can access it
  • an old multi-function device is connected to this local network and needs to write scans to the Samba share

The device cannot write to Samba share. Device's log shows wrong file name error.

Improve this question

1 Answer 1

Reset to default
4

The wrong file name error is misleading. The issue is in Samba server setup.

  1. Edit Samba server configuration: sudo nano /etc/samba/smb.conf
  2. In the [global] section, add these lines:
server min protocol = NT1
ntlm auth = ntlmv1-permitted
  1. Restart Samba for changes to take effect: sudo systemctl restart smbd.service

While trying to fix this issue I spent considerable time checking why the file name was wrong. Once I was sure there was nothing wrong with the file name, I thought there could be something with the Samba protocols being used, because the MFP device has not been receiving software updates for years. In Samba's online documentation I found a way to force the server to accept older protocols (server min protocol). To use SMB1 protocol you need the setting NT1. The device still could not write the scan, this time the error was: file access denied. Misleading again - there was nothing wrong with file permissions. Digging into Samba's online documentation further, I found how authentication protocols evolved, added the ntlm auth line and that was it.
The SMB1 protocol is insecure, but you should get away with it as long as your Samba is accessible only in local network or equivalent like VPN. If you absolutely must open Samba server to the Internet, here's sound advice how to do it (finding this response earlier would have saved me time, but the question was asked differently).

Improve this answer
3
  • Is there ever any real need to have a Samba accessible from the Internet?
    – Chris Davies
    Commented Jun 10 at 23:50
  • 1
    A large chunk of the insecurity associated wit SMBv1 comes not from SMBv1 as the protocol, but rather from Windows' SMBv1 server code (which was notoriously buggy – half of the security gain of SMBv2/3 is due to the fact they went with a clean slate for their SMBv2/3 server and not inherently due to the protocol); none of the exploits that used to run on Windows are going to work against Samba by nature of it being different software, just like IIS exploits don't work against Apache.
    – u1686_grawity
    Commented Jun 11 at 5:23
  • 1
    But on the other hand, another large chunk of the insecurity comes from the use NTLM which still applies just as much to SMBv2/3… (i.e. the other half is insecurity in the sense of "plain-text FTP", not insecurity in the sense of "vulnerable code"), so if you ever wanted to expose a SMB server to the WAN, limiting it to "not SMBv1" wouldn't be enough either way – SMBv3.1 with encryption set to mandatory would be the minimum, and that still retains the issues NTLM has (you'd want to set up Kerberos).
    – u1686_grawity
    Commented Jun 11 at 5:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .