Security – Encrypting SMB traffic with Samba

domain-controllerencryptionsambasamba4Security

We use Samba on Ubuntu 14.04 LTS as a PDC (primary domain controller) with roaming profiles. Everything works fine, except for if we try to enforce encryption via setting:

    server signing = mandatory
    smb encrypt = mandatory

in the [global] section of /etc/samba/smb.conf . After doing so, win 8.0 and win 8.1 clients (haven't tried any other) complain: Die Vertrauensstellung zwischen dieser Arbeitsstation und der primären Domäne konnte nicht hergestellt werden. English translation of this text: The trust relationship between this workstation and the primary domain could not be established.

If we add the two options server signing and smb encrypt only to the [profiles] section of smb.conf, then tcpdump shows, that the actual traffic is not encrypted!

The full smb.conf:

[global]
    workgroup = DOMAIN
    server string = %h PDC
    netbios name = HOSTNAME
    wins support = true
    dns proxy = no
    allow dns updates = False
    dns forwarder = IP

    deadtime = 15

    log level = 2
    log file = /var/log/samba/log.%m
    max log size = 5000
    debug pid = yes
    debug uid = yes
    syslog = yes
    utmp = yes

    security = user
    domain logons = yes
    domain master = yes
    os level = 64
    logon path = \\%N\profiles\%U
    logon home = \\%N\%U
    logon drive = H:
    logon script =

    passdb backend = ldapsam:ldap://localhost
    ldap ssl = start tls
    ldap admin dn = cn=admin,dc=DOMAIN,dc=de
    ldap delete dn = no

    encrypt passwords = yes
    server signing = mandatory
    smb encrypt = mandatory

    ## Sync UNIX password with Samba password
    ldap password sync = yes

    ldap suffix = dc=intra,dc=DOMAIN,dc=de
    ldap user suffix = ou=People
    ldap group suffix = ou=Groups
    ldap machine suffix = ou=Computers
    ldap idmap suffix = ou=Idmap

    add user script = /usr/sbin/smbldap-useradd -m '%u' -t 1
    rename user script = /usr/sbin/smbldap-usermod -r '%unew' '%uold'
    delete user script = /usr/sbin/smbldap-userdel '%u'
    set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'
    add group script = /usr/sbin/smbldap-groupadd -p '%g'
    delete group script = /usr/sbin/smbldap-groupdel '%g'
    add user to group script = /usr/sbin/smbldap-groupmod -m '%u' '%g'
    delete user from group script = /usr/sbin/smbldap-groupmod -x '%u' '%g'
    add machine script = /usr/sbin/smbldap-useradd -W '%m' -t 1

[homes]
    comment = Home Directories
    valid users = %S
    read only = No
    browseable = No

[netlogon]
    comment = Network Logon Service
    path = /var/lib/samba/netlogon
    admin users = root
    guest ok = Yes
    browseable = No

[profiles]
    comment = Roaming Profile Share
    path = /var/lib/samba/profiles
    read only = No
    profile acls = Yes
    browsable = No
    valid users = %U
    create mode = 0600
    directory mode = 0700

Any help?

Best Answer

The smb.conf manual page needs to be updated! It refers to the old Samba-specific encryption mechanism that applies to SMB1 only and is done via unix extensions. This can be used by smbclient.

Nowadays, the "smb encrypt" options also controls the SMB-level encryption that is part of SMB version 3.0 and newer. Windows 8 (and newer) clients should encrypt traffic with these settings.

Have you tried to use the same settings (smb encrypt = mandatory in the [global] section) on a Samba domain member or standalone server?

Make sure to set smb encrypt = auto in [global] section (not the [profiles] section). Then the general availability of encryption is still announced.


It is very possible that this is a bug in Samba. So this should probably be discussed on samba's samba-technial mailing list or samba's bugzilla. If you're using the Ubuntu version of Samba then you might also want to check the package page. I suspect that this a genuine Samba upstream issue.

Related Topic