3 ms·
SMB3 is secure over the internet. But you really have to make sure it is an encrypted connection. In Samba you do this by adding: server min protocol = SMB3 sm
by jra_samba 4y ago
SMB3 is secure over the internet. But you really have to make sure it is an encrypted connection. In Samba you do this by adding:
server min protocol = SMB3
smb encrypt = required
to the [global] section of your smb.conf.
- jchw 4y agoHonestly, I don’t mind a VPN moat on top of even that, but it’s definitely a good tip. Any unencrypted data over a VPN is a liability anyways. That said: for the moment, I still have some SMB1 clients inside my network. Yes, this is terrible, and frankly it is surprising Samba still supports it (I won’t be too surprised or too angry if it gets removed now that it’s separated out.) I should probably segregate SMB1 clients onto a different fileserver on a different VLAN or something. Until then, it would be annoying to force SMB3 on all clients. (As for why Anybody would use SMB1, the answer is retro computing. I also suspect that Open PS2 Loader is an SMB1 client, though I have not checked.)
- jra_samba 4y agoWe just (a week or so ago) added the ability to remove it. You can now configure samba with: --without-smb1-server and the SMB1 code is no longer compiled into the binary :-).