20 comment

1. man smb.conf:
   SMB2: Re-implementation of the SMB protocol. Used by Windows Vista and later versions of Windows. SMB2 has sub protocols available.

   You will prevent Windows 7 machines from connecting..

2. Hello
   Thanks for this, it seems to create problems with Windows 10 clients:
   [2017/05/18] smbd/negprot.c:694(reply_negprot)
   No protocol supported !
   We use port 139, this may be the problem or the old samba version we have. I have to check further
   I had to revert this and can’t find another solution for the moment. (Still searching)

3. Hello.
   I followed this, however, there’s a problem.

   I have a samba server. I added the line on the smb.conf file.
   After that, I could connect the server from Windows 10 machine, but not from Ubuntu(16.04/17.04) file manager and Android(using Total commander) machines.

   It works find without “min protocol = SMB2”.
   Any help?

4. I’ve found the following to work. It raises the bar i little extra, but so far, no complaints have been heard (SMB2_10 should be fine, unless you have Windows XP or older clients).

   The client stuff is to make smbclient (if you use that) skip SMB 1 in negotiations. The client max protocol may appear weird, but if it’s not included, then its value will defaul to something lower than 2.1, and then it will conflict with “client min protocol = SMB2_10”.

   server min protocol = SMB2_10
   client max protocol = SMB3
   client min protocol = SMB2_10

5. After appending “min protocol = SMB2” in global section on my smb.conf server, I no longer connect from my linux laptop. Error displayed: “Error: Connection timed out. Please select another viewer and try again.” in my caja file manager.
   Am using Linux Mint 18.1 Mate as client, with Ubuntu 14.04.5 as server using samba 4.3.11.
   Same error for setting “min protocol = SMB3”.

6. Couple things:

   1) Kaspersky and Symantec have indicated that WannaCry can spread via SMBv2 as well:

   https://securelist.com/blog/incidents/78351/wannacry-ransomware-used-in-widespread-attacks-all-over-the-world/

   2) SMBv2 has consequences — there aren’t POSIX/Unix Extensions for it, so it may not be suitable depending on what clients use your Samba server.

7. Depending on your needs, this is easy and did the trick for my network:
   protocol = SMB3

   1. Ugh, nevermind, that just sets the max protocol.

8. You saved my life!
   Thanks so much…

9. How to do it for nethserver 6.9?

10. Server:
    min protocol = SMB2
    Client:
    smbclient -U=username -N –command=”dir Directory/*” //192.168.0.1/Directory

    Error:
    protocol negotiation failed: NT_STATUS_INVALID_NETWORK_RESPONSE

    1. Use

       protocol = SMB2

       Worked for me with Windows 10 and linux client

11. Sorry for dual posting, but i will not change the server settings. Can i use smbclient with SMB2?
    thank you!
    anouke@isurfer.de

12. For all those who had problems with SMB2 in Vista clients and above: the kernel version included in your system may contains an older cifs.ko kernel module that only supports SMB1 protocol. SMB2 (and later) protocols require a later cifs.ko and thus a later kernel. Try update kernel to support for SMB2 protocol in the cifs.ko kernel module and so can act as a SMB2 client.

    1. cifs.ko kernel module and so can act as a SMB2 server.

    2. Sorry, my text was confusing and incomplete. Please remove it so I can include a better text.

13. On RHEL6/RHEL7 system,
    default: max protocol = NT1 (SMB1)

    So “min protocol = SMB2” can be over max protocol? or which one is higher priority?

    I tested on RHEL6 system (samba server 3.6). One of the windows client was unable to connect to samba server on linux. SMB1 was disabled on windows server because of security concerns like wannacry. And “max protocol” was not set explicitly on samba server. So “max protocol” was NT1(SMB1) as default.
    I set “min protocol = SMB2” on samba server but client couldn’t negotiate with server on protocol (smbd[…]: No protocol supported !)

    Finally we solved the problem by setting “max protocol = SMB2”

    Note: SMB3 protocol is supported by samba server over 4.x

14. This seems to work and prevent the security scanner from barking on SMBv1 support

    in smb.conf:

    ###
    server min protocol = SMB2_10
    client min protocol = SMB2
    client max protocol = SMB3

15. Hello
    I m trying to print from linux to windows Printer ( in Win10 version 1709) with samba protocol without using smbv1 activated ..

    My Windows is used in administrator user

    Can you help me ?

    I’m tryning several things with client /server protocol but dont work ;-(

    Thanks best regards….

    Steflp

16. Stefan’s reply is what fixed months of a headache for me

    adding

    protocol = SMB2

    to /etc/samba/smb.conf
    service smb restart; service winbind restart
    (RHEL 6 server)

    Fixed it’s connection to a hardened 2012 Server as well as a hardened Windows 10 Computer. I’m testing a RHEL6 client now!

Comments are closed.