Security – How to set minimum Samba protocol version without breaking anonymous access

anonymouscifssambasamba4Security

I have a read-only Samba share set up with Samba 4.3.11 on Ubuntu 16.04. This works without issue for publishing some files/tools that need to be available to all hosts.

However, out of the box, this allows for all smb protocol versions. The normal way to address this to make the security guys happy would be to just set min protocol=SMB2 however, that results in:

$ smbclient -N //host.fqdn.com/sharename
protocol negotiation failed: NT_STATUS_INVALID_NETWORK_RESPONSE

Does anyone have any suggestions on how to get this to work?

I've tried the suggestion here (https://www.linuxquestions.org/questions/linux-networking-3/samba-min-protocol-%3D-smb2-causes-protocol-negotiation-failed-nt_status_invalid_network_response-4175597669/) to set 'protocol = SMB3' explicitly, but that doesn't appear to have any effect on the minimum protocol version.

Best Answer

Set the protocol to use. Try with the one that works for you depending on the server you trying to connect:

smbclient -N //host.fqdn.com/sharename -m SMB2

or 

smbclient -N //host.fqdn.com/sharename -m SMB3
Related Topic