Samba SMB Encryption - How safe is it?

Question

I recently set up a Samba server on Linux that allows me to access files on this server on Win10 PCs in my local network. But I wondered if I could access this shared drive over the internet since I also use a Win10 PC at school.

I set the following in my section:

[global]
workgroup = workgroup
security = user
encrypt passwords = true
smb encrypt= required

How good is the SMB encryption really? SMB was known as unsafe for public networking but since SMB3 there's encryption availeable and I wondered how secure this might be.

Thanks in advance.

Answer 1

You could see the Encryption in SMB 3.0: A protocol perspective and Encryption in SMB3 for technical details, but I think the fact that Azure Files allows mounting over the Internet using (only) SMB3 is a sign that Microsoft thinks it's secure.

Answer 2

This question is several years old, but I will try to contribute something recent. The current configuration smb.conf is this (at least it works on Ubuntu 20.04):

[global]

   # smb v4.14 and later
   server signing = mandatory
   server min protocol = SMB3
   server smb encrypt = required
   # smb v4.13 or earlier
   smb encrypt = required

Note: run in terminal samba -V and comment out the line that does not correspond to your version

In my opinion it is quite safe, however in Windows clients it is recommended to execute the following registry keys:

open cmd with administrative privileges and run

reg add "HKLM\System\CurrentControlSet\services\LanmanServer\Parameters" /v "RequireSecuritySignature" /t REG_DWORD /d 1 /f
reg add "HKLM\System\CurrentControlSet\services\LanmanServer\Parameters" /v "EnableSecuritySignature" /t REG_DWORD /d 1 /f

for more information check Samba Full Audit

Note: Windows like Samba change these parameters with each version without prior notice, therefore this answer may be obsolete in 6 months

Answer 3

But I wondered if I could access this shared drive over the internet since I also use a Win10 PC at school.

Samba is a file and print sharing service, i would NEVER ask it to do encryption. If you want to encrypt information between you and Samba (wise choice), i would advice creating an SSH tunnel from your school computer when you are using a public network to the Samba machine.

Their is alot of good explanations on what an SSH tunnel is, how to setup and when to use, and it is designed to do encryption of information between two endpoints, that is what SSH does.

Examples on what SSH tunnel is

• https://www.youtube.com/results?search_query=what+is+ssh+tunnel
• https://www.youtube.com/watch?v=zlv9dI-9g1U

How to make a Windows SSH tunnel

• https://stackoverflow.com/questions/4974131/how-to-create-ssh-tunnel-using-putty-in-windows

Also write what operating system the machine that runs Samba is installed with. Ubuntu, Fedora, Windows something else? So people can give you the best answers possible.

How strong is SSH encryption?

Strong and secure enough for even goverments to use it.

Answer 4

In 2023 (nowadays) I had this question, went through

https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html

and pulled out these related items. I posted them here: https://unix.stackexchange.com/questions/761491/securing-samba-smb-conf-best-parameters

Highlights:

[global]
server min protocol = SMB3_11
server smb encrypt = required
server signing = mandatory
server smb3 encryption algorithms = AES-128-GCM, AES-128-CCM, AES-256-GCM, AES-256-CCM
server smb3 signing algorithms = AES-128-GMAC, AES-128-CMAC, HMAC-SHA256

client min protocol = SMB3_11
client smb encrypt = required
client signing = required
client ipc signing  = required
client protection = encrypt
client smb3 encryption algorithms = AES-128-GCM, AES-128-CCM, AES-256-GCM, AES-256-CCM
client smb3 signing algorithms = AES-128-GMAC, AES-128-CMAC, HMAC-SHA256

# client use kerberos = < off | desired | required >
# kerberos encryption types = < all | strong | legacy >

I wondered if I could access this shared drive over the internet since I also use a Win10 PC at school

that has a 2 part answer

1. First you need access through firewalls & proxy's to gain the basic network access from your client (home PC) to the server (Linux computer at school).
2. Then it would be a matter of both the server and client sync'ing up on the protocol version, which the latest is currently SMB 3.1.1 which would be optimal. But for example I think win10 does not support SMB 2.0 so if the samba server is older and does not support SMB3 protocol then you would not be able to connect. So the server and client have to be in sync configuration-wise.

But in regards to is the SMB encryption safe - yes for windows 10 with SMB 3.1.1 with the AES encryption scheme it's pretty good. For reference this is with samba-4.17.5-3.el8_8 in RHEL 8.8; the current stable samba release is 4.19.2.

Article 05/18/2023 : https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-security

Answer 5

Additionally I would suggest to check with Wireshark that the traffic is encrypted. This is because SMB negotiates encryption as a possibility rather than a requirement. A client cannot force encryption but only deny a non-encrypted connection and it is for the server to decide. Yes, by default Win10 encrypts if the client supports it, but who knows how the server-side registry is tailored in your case. if the data is that sensible, I would not fully believe to Samba's "required" without double check.