2

I've been going down a rabbit hole with SAMBA and CIFS.

We have a server that was pentested, and we were pulled up for "SMB server signing not enforced"

Fine, I thought, I'll just turn server signing on. Then I came up against the different dialects of SMB, and their relationship to CIFS, and why you should never use CIFS.

https://blog.varonis.com/the-difference-between-cifs-and-smb/ http://blog.fosketts.net/2012/02/16/cifs-smb/

But, in my configuration, (SMB server is RHEL 6.7 with samba-3.6.23-30, SMB client is RHEL6.7 with cifs-utils-4.8.1-20), the client uses mount.cifs to mount the share in fstab.

What gives? This seems to be the way to mount a samba share on RHEL, but CIFS is supposed to be a dirty word! mount.smbfs is buggy and deprecated.

Also, how do I know which dialect my samba server is speaking? Apparently samba since 3.6 supports SMB2, but how do I enable it (I've tried max protocol = SMB2 in the [global] section of smb.conf), and make sure it's actually doing it?

How do I enable message signing, and crucially, check that it is actually doing it?

The pentester used nmap to discover message signing was disabled, but I don't have that available. Any way with standard linux tools?

Improve this question
4
  • you can easily just install nmap, its free. – mzhaase Sep 16 '16 at 10:50
  • I know, but I am working in a very locked down environment where installing anything requires multiple hoops to be jumped through, totalling weeks of time usually – gtmcclinton Sep 16 '16 at 11:01
  • Do you have tcpdump? – mzhaase Sep 16 '16 at 11:02
  • Yes, I have tcpdump. I have discovered that RHEL6 will do SMB2 as a server, but the cifs kernel module does not support SMB2, RHEL7 is needed for mounting SMB2 shares. Would have liked SMB2, but now all I can do is enable signatures. How can I prove they are enabled using tcpdump? – gtmcclinton Sep 16 '16 at 13:40
1

As per the mount.cifs manpage:

The CIFS protocol is the successor to the SMB protocol and is supported by most Windows servers and many other commercial servers and Network Attached Storage appliances as well as by the popular Open Source server Samba.

Further in this manpage, the CIFS/SMB2 protocol is mentioned repeatedly. Obviously, in ordinary Linux and Samba parlance, CIFS equals SMB2.

However the CIFS kernel documentation is more precise:

The Linux cifs kernel client has been included in the kernel since 2.5.42. The cifs protocol (and related earlier SMB dialects) is the default ("vers=1.0") but support for newer dialects (SMB2.02, SMB2.1 and SMB3 and SMB3.02) can be selected by specifying "vers=2.0" or "vers=2.1" or "vers=3.0" or "vers=3.02" on mount.

So the answer is clear: you should use mount.cifs anyway. Your kernel ability to use SMB protocols higher than 2.0 should be tested, though (RedHat kernels are very heavily patched and bear little resemblance with vanilla kernels with the same version number).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.