Enabling SMB2 in Alt-F (1.0)

[Paulo Elifaz Andrielli]

Hi guys, 

I'm running Alt-F 1.0 on a DNS 323 B1.

I stumbled upon many topics here, and didn't find a way to activate the SMB2 in Alt-F (I believe I can have some improvement than default SMB1 enabled).

I heard that this option is available under menu SERVICES > NETWORK (thanks, Chris!), and then, a checkbox appears, but in my case, it doesn't!

Samba version which I'm using is this one:

samba-small

3.5.22-1

The stripped-down version of Samba shipped in the firmware.

Any hints on that?

[]´s

Paulo

[Chris Archer]

Hi Paulo:

A few things seem to be different between your install and mine:

1. Samba version should be 3.6.25, e.g. from ssh

smbstatus

Samba version 3.6.25
PID     Username      Group         Machine
-------------------------------------------------------------------

Service      pid     machine       Connected at
-------------------------------------------------------

No locked files


2. Since 0.1RC6 there should definitely be check boxes for SMB2. I'm attaching screen shots from Services -> Network -> smb -> Configure and the firmware pages for my 0.1RC6 and 1.0 boxes

Hope this helps,
Chris.

[Paulo Elifaz Andrielli]

Hummm..... That's interesting.....

I got mine upgraded to RC5, and when the network corruption was detected, I rolled back to RC4. Then, I got upgraded directly to 1.0.

Is this something that was just implemented in RC6?

[]'s
Paulo
sent from Android

--
You received this message because you are subscribed to the Google Groups "Alt-F" group.
To unsubscribe from this group and stop receiving emails from it, send an email to alt-f+unsubscribe@googlegroups.com.
Visit this group at https://groups.google.com/group/alt-f.
For more options, visit https://groups.google.com/d/optout.

[Chris Archer]

Hi Paulo:

I think the SMB2 checkbox was introduced in RC6, and the SMB1 checkbox was introduced in 1.0
Joao is the one who can provide a definitive answer, but I'm guessing that if RC6 or 1.0 is installed properly, those settings should be in the UI.

I'd say first check your firmware page to confirm that it looks similar to what I posted. I know there was a point where the UI would say I had installed a version of Alt-F but the kernel versions on the firmware page did not match the new one.

Also if I recall correctly there were two snapshot releases for 1.0, one in March and the other more recently on June 16. You might want to make sure you're using the June 16 one (https://sourceforge.net/projects/alt-f/files/Snapshots/2017-06-16/)

Chris.

To unsubscribe from this group and stop receiving emails from it, send an email to alt-f+un...@googlegroups.com.

[João Cardoso]

On Wednesday, 28 June 2017 17:24:01 UTC+1, Chris Archer wrote:

Hi Paulo:

I think the SMB2 checkbox was introduced in RC6, and the SMB1 checkbox was introduced in 1.0

Right

 

Joao is the one who can provide a definitive answer,

But I'm now in a long holidays and away from my boxes, so I can't give exact info.

In any case, at boot time Alt-F tries to see if it was (flash) upgraded, and if so it tries to remove old disk-installed packages that might now be outdated and included in the new firmware.

If that fails, under Packages->Alt-F you can see duplicated entries for the same package, e.g., samba-3.5.22 and samba-3.6.25, or a package that existed in the the previous firmware and couldn't be removed can now be removed (the Remove button is now enabled).

So, if Alt-F 1.0 appears in the fw upgrade page (see bellow), samba 3.5.22 should not appear as an installed package (and Paulo, your screen shots showns the samba-3.5 webUI). I would recommend anyone trying snapshots to remove old samba 3.5 packages.

For the DNS-321/323, samba-small is shipped in the firmware, and if samba (not small :-) has been installed on disk on the previous fw, it will override the one shipped in the new fw. That is probably what is happening to you Paulo.

but I'm guessing that if RC6 or 1.0 is installed properly, those settings should be in the UI.

I'd say first check your firmware page to confirm that it looks similar to what I posted. I know there was a point where the UI would say I had installed a version of Alt-F but the kernel versions on the firmware page did not match the new one.

Yes, that has been reported by several users, and the firmware upgrade initial web page shows both the flashed (and "running", as for the 321/323 they can be different) linux kernel and the rootfs versions. So you can check if both have been correctly flashed, as Chris snapshots showns. The firmware file contains both the kernel and rootfs and during flashing both should be flashed.

Also if I recall correctly there were two snapshot releases for 1.0, one in March and the other more recently on June 16.

That is not right, only one of RC6 and 1.0 snapshots has been made available. Both use kernel 4.4.45.

[Tom Schmidt]

My DNS-323 likewise did not show the SMB1/2 checkboxes on 1.0.  I found that I did have the older samba 3.5.22 packages installed, so after removing them, it showed I have samba 3.6.25 and now I have the SMB1/2 checkboxes in the Samba configuration option.

Tom

To unsubscribe from this group and stop receiving emails from it, send an email to alt-f+unsubscribe@googlegroups.com.

[Paulo Elifaz Andrielli]

Hi guys,

gotcha! I just removed the Samba 3.5.22, and on refreshing screen, it showed the 3.6.25 installed, which I cannot remove (since it's built-in, I think).

samba-small

3.6.25

The stripped-down version of Samba shipped in the firmware.

Now I see the options that Chris said before:

So, if user does not have this option, solution is just try to uninstall the Samba, which might being overlapping the newest one, correct?

Thanks for that, guys!

[]´s

Paulo

[Chris Archer]

Glad it's finally working for you Paulo.

Thanks to Tom for the solution and as always to Joao for the software and support even when he's on holiday!  :-)

Chris.

[steven samson]

Hi Joao,

It should be necessary to disable "nt pipe support = no" in smb.conf due to https://www.samba.org/samba/security/CVE-2017-7494.html.

Or just patch the code, https://download.samba.org/pub/samba/patches/security/samba-4.6.3-4.5.9-4.4.13-CVE-2017-7494.patch

Steven

[João Cardoso]

On Saturday, 14 October 2017 13:10:57 UTC+1, steven samson wrote:

Hi Joao,

It should be necessary to disable "nt pipe support = no" in smb.conf due to https://www.samba.org/samba/security/CVE-2017-7494.html.

Or just patch the code, https://download.samba.org/pub/samba/patches/security/samba-4.6.3-4.5.9-4.4.13-CVE-2017-7494.patch

The  CVE-2017-7494 patch is applied, so there is no need to tweek smb.conf

Thanks

PS-The patches applied are:

jcard@silver:~/Alt-F/alt-f-sf> cat build/build_arm/samba-3.6.25/.applied_patches_list 

samba-3.6.25-010-patch-cve-2015-5252.patch

samba-3.6.25-011-patch-cve-2015-5296.patch

samba-3.6.25-012-patch-cve-2015-5299.patch

samba-3.6.25-015-patch-cve-2015-7560.patch

samba-3.6.25-020-CVE-preparation-v3-6.patch

samba-3.6.25-021-CVE-preparation-v3-6-addition.patch

samba-3.6.25-022-CVE-2015-5370-v3-6.patch

samba-3.6.25-023-CVE-2016-2110-v3-6.patch

samba-3.6.25-024-CVE-2016-2111-v3-6.patch

samba-3.6.25-025-CVE-2016-2112-v3-6.patch

samba-3.6.25-026-CVE-2016-2115-v3-6.patch

samba-3.6.25-027-CVE-2016-2118-v3-6.patch

samba-3.6.25-028-CVE-2017-7494-v3-6.patch

samba-3.6.25-100-configure_fixes.patch

samba-3.6.25-110-multicall.patch

samba-3.6.25-111-owrt_smbpasswd.patch

samba-3.6.25-112-allow-swat-frame.patch

samba-3.6.25-115-multicall2.patch

Steven

To unsubscribe from this group and stop receiving emails from it, send an email to alt-f+unsubscribe@googlegroups.com.

[steven samson]

Nice.