#smb.conf

[nixcraft]

How to configure Samba to use SMBv2 and disable SMBv1 on Linux or Unix - nixCraft

Explains how to configure Samba to use SMBv2/SMBv3 and disable SMBv1 on Linux or Unix-like systems for security reasons such as WannaCrypt/WannaCry.

Stay safe. Avoid security issues on your Linux or Unix smb server.

[nixcraft]

How to configure Samba to use SMBv2 and disable SMBv1 on Linux or Unix - nixCraft

Explains how to configure Samba to use SMBv2 and disable SMBv1 on Linux or Unix-like systems for security reasons.

WannaCrypt/WannaCry targets the Microsoft Windows operating system and Linux based Samba server too. Here is how to protect your box.

[giko-ha]

smb.conf

紆余曲折を経て、なんとか本番可動にこぎつけたけど、sambaのスループットがなかなか上がらない。 NICが蟹なので、ドライバの問題とかも当然対処済みなんだが、一向にダメ。

iperfでスピード測定したら、ネットワーク自体は930Mbps出てるので、問題ないみたい。

ってことで、面倒だけど、smb.confのチューニングをすすめることに。 出来れば、700Mbps(約87.5MB/s)は出て欲しいんだけど、どこまでいけるか？

なぜかmssが1448だったので、とりあえずsocket optionsのSNDBUFとRCVBUFのサイズを、それぞれ101360(x70)で設定してみたところ、無設定のスループットにほど近い、40MB/sまでは到達。 ここから、どれだけ上げられるか、地道に調整。

[yaecom3]

[iamrootusr]

CentOS 6.2 and Encountered Issues while setting up a Samba Share

Today I was told to create a Samba share for my Windows box. I have finished that task, and unfortunately have had lots of fun trying to figure out what went wrong where with the box. (Also, Debugging is wonderful!) By the way, I'm going to be logging the errors and such I've experienced while learning about UNIX and Linux systems, and linking/posting the solutions to those problems so that others may find them all in one place and useful. And so that I can look back here when I encounter an issue again.

Anyway, I thought it would be prudent to share what I have subsequently discovered in one place, so that when others have issues with this same problem, they would not have to dig around Google's search engine to find the answers.

What worked for me is at the very bottom of this post.

While setting up the server, I had difficulties connecting from my Windows 7 Home Premium box to the CentOS server.(I recall the error specifically being that the Win7 box could not connect to the CentOS box.) The first problem I encountered was the CentOS firewall. So I had to turn that off.

/etc/init.d/iptables stop And once that was off, the Win7 box ceased complaining that it could not connect. Now the error encountered was that I did not have the permissions to access the box.

And the permissions part was the fun part. I went through multiple solutions to try and fix the problem, and none of them worked. However, I will list them here in the hopes that perhaps the following fixes will help solve your problem, dear internet reader.

testparm is your friend!

testparm helped me identify some of the issues I had with mysmb.conffile, which may be the issue some of you have when trying to connect.

[root@localhost Caitlin]# smbclient -U Caitlin -W WORKGROUP //192.168.1.95/Caitlin Enter Caitlin's password: Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.5.10-116.el6_2] tree connect failed: NT_STATUS_ACCESS_DENIED

The issue I had was that I had not set [homes]         comment = Home Directories         browseable = no         writable = yes         available = yes         read only = no         valid users = %S ;       valid users = MYDOMAIN\%S [homes] to available. Hence my trouble connecting. (I ran into the same issue with [printers] as well.)

Windows 7 Home Premium Might be the Problem

Microsoft is well-known for packaging Windows in different 'versions' that separate the different features of Windows from each other. I assume that the idea behind this is to help the everyday consumer who doesn't need certain features pay less than the business user who needs more than an empty box. The problem with this is that certain fixes that work just fine in Windows 7 Professional won't work in Windows 7 Home Premium. This can be frustrating for those trying to fix the issue, only to find that "Local Security Policy" doesn't exist on their version of Windows.

In the "Advanced Sharing Settings" of the Homegroup settings, you can tell Windows 7 Home Premium to "Enable file sharing for devices that use 40- or 56-bit encryption" and this might help. (I'm not entirely sure if that will fix the problem though...)

The fix that works for most people, however, is the one found here and is at the bottom of the page. For those of you too lazy to click the link:

1 . Open registry editor ( Start search – regedit) 2 . Browse to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa 3. Create a new DWORD(32-bit)  value with the following properties: NAME: LmCompatibilityLevel VALUE: 1 4. Restart your PC and try the connection again…

SELinux is Evil (Kind Of)

Orignially, SELinux was developed by the NSA to make Linux more secure so that they would have a secure OS that was more or less, safer from hacking than any other current OS. The idea was security. The implementation made everyone who encountered it and didn't know it was running want to tear their hair out.

This is the issue I ran into: I had a freshly installed CentOS box, and started running smb and trying to access files remotely. SELinux does not like that when it's in enforcing mode. It acts kind of like an overprotective germaphobic parent, "You're not allowed to play in the dirt! Think of all the completely harmless but somehow very scary bacteria in there!" only it's, "I haven't said you could do 'x', so any activities involved with 'x' aren't allowed, including 'xy'.

Apparently, you need to explicitly state in the smb.conf file that certain files have permissions to do certain things. However, most people opt to disable SELinux instead, because it's less of a pain in the arse to shut it up than to go through your code and text and tag it with the proper syntax.

I opted to set SELinux to 'permissive' mode, which doesn't block the operations you're attempting to do, but 'warns' you about them instead. Turning that off fixed this: NT_STATUS_ACCESS_DENIED listing \*

Which made me very happy and had all my files show up nice and proper in my terminal. So that's something to keep in mind if you're not familiar with the box you're using.

(I found the solution for SELinux here and so far have not experienced any other errors with my smb server.)

Thanks for reading and I hope whatever I've discovered helps you guys out! Feel free to comment with tips or questions and I'll try to answer them to the best of my ability, but honestly, I'm a beginner myself, so I don't know how much help I'll be... >.<

Have a nice day!

Also, tips for writing this blog and formatting it will be very much appreciated. Thanks!

[sip2serve]

Win7 samba issue on ubuntu Precise 12.04

I like many others upgraded to the new LTS (Long Term Support) version of ubuntu that was released in April, commonly referred to as Precise or 12.04

Initially everything looked fine, then things seemed to become unstable. perhaps a better way of describing the issue is that windows 7 clients could browse although slowly sometimes and download small files but would falter and fail if large files were downloaded.

It is hard to say the exact sequence of events, suffice to say after two weeks and a couple of reboots of the ubuntu server I have managed to find at least one workaround. looking back it would seem two things were evident:

slow downs occerred and a reboot of the server on at least one occasion returned download speeds back to satisfactory levels

windows 7 was affected, whereas Linux, Android and the Windows XP SMB clients were not.

It would not surprise me if one or more new memory leaks have krept into the mix with the upgrade to 12.04 and this would account for item 1 above, only time and the ability to narrow down the issue will assist.

However, for the second item a workaround is possible that allows speeds simialar to the 11.10 samba package.

Add the following line to the global setting of /etc/samba/smb.conf file:

max protocol = NT1

I kept all other configuration lines as I had them from 11.10 version of my smb.conf file.

Afterwards reboot your windows 7 clients and try to transfer files you should see a vast improvement.

The workaround was found like so many other things by searching long and hard with google, thanks to Ryan Davies who actually found the solution in amongst the google hits.

ciao

Paul