latest ARMHF image broke SMB for my older clients.

[SenorSmartyPants]

When I updated to latest armhf my older clients could no longer connect. Some are SMB clients in hardware video clients.

Luckily I was able to roll back to the local image still in my container cache. But there is no current way to pull older images from docker hub.

Please add version/release tags to the images hosted on docker hub. This will allow pinning at older versions if anything breaks in newer versions.

Thanks for all your work.

[pabloromeo]

Any idea why the latest version is now broken? Same thing happened to me. I get "unsupported platform" now, on the same hardware, and can't reference the previous version since it's not version tagged.
Could the qemu build be broken?

[SenorSmartyPants]

I went back and compared my smb.conf to the changes here and I think mine was generated around this commit abb29e0 .

I added a couple global options to my dockerfile to change security settings back to how I had them setup, versus the new defaults.

      GLOBAL: "client ipc max protocol = default"
      GLOBAL: "client max protocol = default"

But no luck. My old client just hangs on connecting to the server. I did a little more checking and noticed /etc/samba/smb.conf in the container did not get updated when I ran the latest image. I confirmed this be noticing new default values are not included. And I changed my global options to different values and that was not reflected in smb.conf either.

[majestixx]

I think I have the same issue.
Watchtower updated my samba container today and now my kodi client is not able to connect to the container anymore. Windows is still able to connect and the S-Flag is set.
Unfortunately I have no idea how to downgrade to an older version.

[wdullaer]

I have similar issues with sonos not being able to connect anymore.
Despite the -S flag being set, SMB1 seems to still be disabled.

Running smbclient in the container gives the following

bash-5.0# smbclient -L //localhost -N

	Sharename       Type      Comment
	---------       ----      -------
	share           Disk      
	IPC$            IPC       IPC Service (Samba Server)
SMB1 disabled -- no workgroup available

I have -S set and the lines with min protocol in /etc/samba/smb.conf are correctly removed

If I start with the following custom global, it works

GLOBAL: "client min protocol = NT1"

[christianeuropa]

@wdullaer I do the same but I still get an error message

bash-5.0# smbclient -L //localhost -N

    Sharename       Type      Comment
    ---------       ----      -------
    SonosSpeak      Disk
    nuc             Disk
    IPC$            IPC       IPC Service (Samba Server)
Reconnecting with SMB1 for workgroup listing.
smbXcli_negprot_smb1_done: No compatible protocol selected by server.
protocol negotiation failed: NT_STATUS_INVALID_NETWORK_RESPONSE
Unable to connect with SMB1 -- no workgroup available

Any idea why?

[Hugues-Antoine]

it works with :

GLOBAL: "min protocol = NT1"

[christianeuropa]

@Hugues-Antoine
thanks, thats works for me too

[majestixx]

it works with :

GLOBAL: "min protocol = NT1"

Problable a stupid question, but how do I pass the variable in a docker-compose file
This is not working for me:
environment: - USERID=1000 - GROUPID=1000 - GLOBAL="min protocol = NT1"

[dperson]

Okay, I think sambas default for the minimum protocol changed. Now instead of defining the minimum for -s and SMB I'm setting it to be LANMAN1 the earliest sane protocol. Give that a shot. But you should think about updating your clients eventually...

[SenorSmartyPants]

I would update clients, but I have some hardware devices that will never get updates.

[christianeuropa]

Now sonos is not working again. Do I have to use another global variable now?

[rodrigc]

I think I'm running into the same problem. I think I pulled down a newer container, and have in my smb.conf:

   # Security
   client ipc max protocol = SMB3
   client ipc min protocol = SMB2_10
   client max protocol = SMB3
   client min protocol = SMB2_10
   server max protocol = SMB3
   server min protocol = SMB2_10

I am trying to interoperate with a Supermicro Baseboard Management Controller (BMC) which has an embedded SMB implementation, and now cannot mount shares.

How do I set the minimum protocol to something earlier?

I'm passing these args to the container:

      - args:
        - -s
        - Public;/Public
        - -w
        - WORKGROUP
        - -S

[rodrigc]

I saw this in /usr/bin/samba.sh:

### smb: disable SMB2 minimum
# Arguments:
#   none)
# Return: result
smb() { local file=/etc/samba/smb.conf
    sed -i '/\([^#]*min protocol *=\).*/\1 LANMAN1/' $file
}

but when I tried to run this manually:

 sed -i '/\([^#]*min protocol *=\).*/\1 LANMAN1/' /etc/samba/smb.conf

I got:

sed: unsupported command \

I tested this: #290

and it seems to fix it.

[wdullaer]

I'd happily disabled SMB1, but this is the only protocol sonos supports for a local collection.
I've spent multiple days looking for alternatives, but they're all bigger security risks than this (ie: involve opening up my internal network to the internet).

For reference, here is an example docker-compose file that works for me:

version: "3.7"

services:
  samba:
    image: dperson/samba
    restart: unless-stopped
    network_mode: host
    volumes:
      - "/mnt/data:/mount"
    environment:
      WORKGROUP: WORKGROUP
      SHARE: "share;/mount;yes;no"
      NMBD: 1
      GLOBAL: "client min protocol = NT1"
    logging:
      driver: "json-file"
      options:
        max-size: "10M"
        max-file: "2"

[dperson]

Thanks @rodrigc! I fat fingered that. It should be fixed now.

[rodrigc]

@dperson Thanks! Your container is very handy. I have it running inside a Kubernetes pod, and use it to serve ISO images via smb which can be mounted from the BMC of Supermicro and Dell machines. When I could not mount these ISO's any more, it is hard to debug, because these hardware platforms have embedded SMB implementations and don't provide good logs.
I had to start using Wireshark to see what was going wrong. :)

[RezzZ]

I'd happily disabled SMB1, but this is the only protocol sonos supports for a local collection.
I've spent multiple days looking for alternatives, but they're all bigger security risks than this (ie: involve opening up my internal network to the internet).

For reference, here is an example docker-compose file that works for me:

version: "3.7"

services:
  samba:
    image: dperson/samba
    restart: unless-stopped
    network_mode: host
    volumes:
      - "/mnt/data:/mount"
    environment:
      WORKGROUP: WORKGROUP
      SHARE: "share;/mount;yes;no"
      NMBD: 1
      GLOBAL: "client min protocol = NT1"
    logging:
      driver: "json-file"
      options:
        max-size: "10M"
        max-file: "2"

tried your settings, still can't get sonos to connect unfortunately.
my macbook can connect with every change in settings I tried. Sonos returns a denied. check username and password.
In container logging I see:

Unknown parameter encountered "client min protocol"
Ignoring unknown parameter ""client min protocol"
Unknown parameter encountered: ""min protocol"
Ignoring unknown parameter ""min protocol"

[RezzZ]

finally got it working for sonos:
had to add 1 extra global option (besides the :

    - GLOBAL=client min protocol = NT1
    - GLOBAL2=ntlm auth = ntlmv1-permitted

https://en.community.sonos.com/setting-up-sonos-228990/fail-to-connect-to-samba-share-folder-solved-6836651

[martinpichlo]

to get my canon maxify mb5150 working I need two adjustments

First: "server min prototcol" instead of "client min protocol" (as written in the last link of RezzZ )

GLOBAL1: "ntlm auth = ntlmv1-permitted
GLOBAL2: "server min protocol = NT1"

Second:

• I have to use an IP-Adress within the SMB-Path instead of an IP-Adress

Question:

• generally name resultion within SMB-Paths is working on my maxify. I'm using it with an SMB Share on my Synology NAS.
• Does anyone know how to get name resultion working with SMB1?

[mattelacchiato]

This does not work for me.

I've set everything I could:

      TZ: "Europe/Berlin"
      NMBD: "true"
      GLOBAL1: "min protocol = NT1"
      GLOBAL2: "client min protocol = NT1"
      GLOBAL3: "server min protocol = NT1"
      GLOBAL4: "ntlm auth = ntlmv1-permitted"
      GLOBAL5: "log level = 2"
      GLOBAL6: "client ipc min protocol = NT1"
      USER: "nas;<password>;1001;nas;1001"
      SHARE: "nas;/media/nas;yes;no;no;nas;none;none;Netzlaufwerk"
      WORKGROUP: "WORKGROUP"
      RECYCLE: ""

My resulting smb.conf looks like this:

[global]
   log level = 2
   min protocol = NT1
   ntlm auth = ntlmv1-permitted

...

   # Security
   client ipc max protocol = SMB3
   client ipc min protocol = NT1
   client max protocol = SMB3
   client min protocol = NT1
   server max protocol = SMB3
   server min protocol = NT1

But running smbclient with NT1 leads to this error:

$ smbclient -U nas -L  '\\<ip or name - does not matter>' -m NT1
lp_load_ex: Max protocol NT1 is less than min protocol SMB2_02.
protocol negotiation failed: NT_STATUS_INVALID_PARAMETER_MIX