SAMBA, CIFS, message signing, confusion

cifssambaserver-message-block

I've been going down a rabbit hole with SAMBA and CIFS.

We have a server that was pentested, and we were pulled up for "SMB server signing not enforced"

Fine, I thought, I'll just turn server signing on. Then I came up against the different dialects of SMB, and their relationship to CIFS, and why you should never use CIFS.

https://blog.varonis.com/the-difference-between-cifs-and-smb/
http://blog.fosketts.net/2012/02/16/cifs-smb/

But, in my configuration, (SMB server is RHEL 6.7 with samba-3.6.23-30, SMB client is RHEL6.7 with cifs-utils-4.8.1-20), the client uses mount.cifs to mount the share in fstab.

What gives? This seems to be the way to mount a samba share on RHEL, but CIFS is supposed to be a dirty word! mount.smbfs is buggy and deprecated.

Also, how do I know which dialect my samba server is speaking? Apparently samba since 3.6 supports SMB2, but how do I enable it (I've tried max protocol = SMB2 in the [global] section of smb.conf), and make sure it's actually doing it?

How do I enable message signing, and crucially, check that it is actually doing it?

The pentester used nmap to discover message signing was disabled, but I don't have that available. Any way with standard linux tools?

Best Answer

As per the mount.cifs manpage:

The CIFS protocol is the successor to the SMB protocol and is supported by most Windows servers and many other commercial servers and Network Attached Storage appliances as well as by the popular Open Source server Samba.

Further in this manpage, the CIFS/SMB2 protocol is mentioned repeatedly. Obviously, in ordinary Linux and Samba parlance, CIFS equals SMB2.

However the CIFS kernel documentation is more precise:

The Linux cifs kernel client has been included in the kernel since 2.5.42. The cifs protocol (and related earlier SMB dialects) is the default ("vers=1.0") but support for newer dialects (SMB2.02, SMB2.1 and SMB3 and SMB3.02) can be selected by specifying "vers=2.0" or "vers=2.1" or "vers=3.0" or "vers=3.02" on mount.

So the answer is clear: you should use mount.cifs anyway. Your kernel ability to use SMB protocols higher than 2.0 should be tested, though (RedHat kernels are very heavily patched and bear little resemblance with vanilla kernels with the same version number).

Related Topic