Samba SMB1/SMB2 share issues in Windows 10

[Alex Gibson]

Hi all

 

I have a Buffalo Linkstation Mini which Windows 10 stopped supporting.

 

Model number on sticker is LS-WS1, model in software is LS-WSGL/R1

Firmware is F/W 1.06

 

 

This works perfectly from Windows 7 but I’m trying to retire my last Windows 7 PC.  The problem is that Windows 10 had a patch to deprecate SMB1 as it’s an obsolete.

 

I followed these instructions https://forums.buffalotech.com/index.php?topic=24630.0 to add in some config to force it to use SMB2 protocol

 

But this seems to do nothing – even if I remove the backspaces as suggested elsewhere.  I still get the Windows 10 error above, and in Windows 7 it works perfectly. 

 

I don’t want to revert Windows 10 to SMB1 as that’s insecure, and I don’t want to throw away the device as its twin drives are quite new.

 

I understand that these Buffalo NAS devices are highly hackable little linux computers people have re-purposed for all sorts of things – so I wonder if anyone could give me pointers on figuring out:

1)      whether the code for SMB2 protocol is present on the device

2)      how to install it if it isn’t, when repo access doesn’t seem to be present on the device?

 

Many thanks,

 

Alex Gibson

 

+44 7813 810 765    @alexgibson3d    37 Royal Avenue, Reading RG31 4UR

 

admg consulting

 

edumaker limited

 

·         Project management

·         Operations & Process improvement

·         3D Printing

 

[donke...@gmail.com]

The second half of that might do the trick?

https://www.buffalotech.com/knowledge-base/windows-10-cannot-access-shares-on-nas

[Alex Gibson]

Thanks but the first part relates to enabling SMB2 on more recent devices – mine doesn’t have it in the menus…

 

The second part relates to forcing Windows 10 to use SMB1 which is less secure.

 

I am keen to update my older LinkStation Mini to use SMB2.  

 

Either by enabling it if it’s already on there (already tried to using internet guides for similar models and it didn’t work but also didn’t break anything) or by newly installing the SMB2 protocol onto the device, which I understand is a hackable linux computer so it doesn’t seem too wild to attempt this… I am able to get root access to the device via Putty/WinSCP.

 

Cheers,

 

Alex Gibson

 

+44 7813 810 765    @alexgibson3d    37 Royal Avenue, Reading RG31 4UR

 

admg consulting

 

edumaker limited

 

·         Project management

·         Operations & Process improvement

·         3D Printing

 

--
You received this message because you are subscribed to the Google Groups "rLab / Reading's Hackspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to reading-hacksp...@googlegroups.com.
To view this discussion on the web, visit https://groups.google.com/d/msgid/reading-hackspace/551268b8-05ef-41d9-a178-425a35ff4364n%40googlegroups.com.

 

Virus-free. www.avg.com

 

[Mr.G]

Assuming you're not putting your NAS straight on the internet without a firewall I can't see much problem in enabling SMB1 in WIndows 10

I would consider putting your NAS' in a separate vlan

You can enable it form Powershell

Enable-WindowsOptionalFeature -Online -FeatureName smb1protocol

or(Enable-WindowsOptionalFeature -Online -FeatureName "SMB1Protocol-Client" -All)

or disable it

Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol

Source::
https://docs.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/detect-enable-and-disable-smbv1-v2-v3

Best wishes

Mr.G

To view this discussion on the web, visit https://groups.google.com/d/msgid/reading-hackspace/00b601d6dbdc%241e05c130%245a114390%24%40alexgibson.net.

[Stuart Ward]

Alex

I would think that nas_configgen is only run when a new SMB share is created. I suggest having a look at /etc/samba/samba.conf see if the "min protocol = SMB2" or "server min protocol = SMB2" is set.

See https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html for configuration options on the samba.conf file

Stuart

--

You received this message because you are subscribed to the Google Groups "rLab / Reading's Hackspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to reading-hacksp...@googlegroups.com.

To view this discussion on the web, visit https://groups.google.com/d/msgid/reading-hackspace/008c01d6dbd5%2471342c90%24539c85b0%24%40alexgibson.net.

-- 
-- Stuart Ward +44 778 2325143

[Alex Gibson]

My network is CURRENTLY just a broadband modem-router from the provider, plus multiple switches and access points.  So the only protection from the internet is from the broadband router.  Is that ‘enough’?

 

I’ve finally run a two-channel fibre optic link from my house to my workshop, so I can now start to implement a trusted and untrusted network setup so I can at last use a bunch of home automation stuff while still wearing my tin foil hat – but I’d want the NAS to be on the trusted leg, and ideally get it up to a ‘secure’ standard!

 

What I don’t fully understand is that having followed instructions which I believe work on newer Buffalo NAS devices to force them up to SMB2, my device now has several config files telling it to use protocol SMB2 – but these seem not to have any effect at all – Windows 10 errors saying it’s SMB1 protocol.  I’d have expected the tweaks I made to break SMB1 so it would bot work on the Windows 7 machine and have to roll it back!  And although it contains a directory called ‘samba’ I can’t seem to find trace of an installed samba application – and being an embedded device, there are none of the usual package managers available to use to download missing software…

 

Cheers,

 

Alex Gibson

 

+44 7813 810 765    @alexgibson3d    37 Royal Avenue, Reading RG31 4UR

 

admg consulting

 

edumaker limited

 

·         Project management

·         Operations & Process improvement

·         3D Printing

 

To view this discussion on the web, visit https://groups.google.com/d/msgid/reading-hackspace/CAHr2rBzu312n6HRzrtmkkJeTwphZjYWrMA7dLpETCHy4-m_%2Bxw%40mail.gmail.com.

[Stuart Ward]

Alex

I would have a look as see if you can see how samba is started up. There should be a directory /etc/init or /etc/init.d see if you can find something that starts up samba.

Try $ grep -r samba /etc/init/*

But the configuration should still be in /etc/samba/samba.conf

Personally I think that nfs is a far better and simpler networking file technology

Stuart

To view this discussion on the web, visit https://groups.google.com/d/msgid/reading-hackspace/012901d6dc44%2419a997c0%244cfcc740%24%40alexgibson.net.

[Mr.G]

Alex

Just my opinion

BBprovider modem routers are often quite rubbish and have limited configuration options; they often allow every device internally to talk to the whole internet on any port. I would generally advise a separate router that has some granularity of rules say

Internal web browsers that need to talk to the internet can talk 80/443 (SSL) to the internet and what other ports are required if not these by exception.

all other devices can only talk to internal devices with the ports they require.

Starting from a base of "any any deny" and open up ports as required. There  should be no reason a NAS internally should want to talk SMB or anything else directly to the internet (I wouldn't allow remote management). If I wanted remote management I would set up a hardened workstation and talk to that from the internet and let that talk to the NAS and not allow it for other trivial purpose. It goes without saying that you should up-to-date OS, patched, run Antivirus, and maybe most important a least permissive configuration.

I should probably ask how you are backing up these NAS but that would open a can of worms.If you don't do it regularly then you SHOULD especially  if your livelihood relies on your data.You want to do this before it all gets encrypted by some bad actor.

Best wishes

Mr.G

To view this discussion on the web, visit https://groups.google.com/d/msgid/reading-hackspace/012901d6dc44%2419a997c0%244cfcc740%24%40alexgibson.net.