The smb-protocols nmap script checks to see which smb dialects are present on the Samba server.
client min protocol sets the minimum smb dialect that server can use to connect to another server not the minimum dialects that a client to this server can use.
By default the version of samba used in Ubuntu 18.04 sets the server min to NT1 ( smbv1 ) and the max to SMBv3.
If you want to restrict access to this server to SMB3 and SMB3 only you need to set the server min protocol:
server min protocol = SMB3
*Note: there are sub-variants to this dialect:
SMB3_00: Windows 8
SMB3_02: Windows 8.1
SMB3_10: early Windows 10
SMB3_11: Windows 10
By default SMB3 in smb.conf selects the SMB3_11 variant.*
Answer from Morbius1 on askubuntu.comwindows ce - How to enable SMB1 as default and disable SMB2 and SMB3 on Ubuntu 18.04 Server? - Stack Overflow
SMB.conf help
Smb.conf Default Configuration with samba-support - Feedback - Garuda Linux Forum
networking - Set SMB2 protocol in Samba 3.6.6 - Unix & Linux Stack Exchange
First, there is no such thing as a HomeGroup in Linux, MacOS, or Windows starting with Win10.
Second, if you are talking about that specific error when running smbclient you would need to enable SMB1 ( Samba calls it NT1 ) on the client side in /etc/samba/smb.conf. Right under the workgroup = WORKGROUP line add this one:
client min protocol = NT1
Of course the server you are trying to connect to must have SMB1 enabled on its side. If you kept your Win10 machine up to date it is disabled so you will have to enable it there. If the server is running Ubuntu 20 or anything with the same version of samba you would have to edit smb.conf on that machine and add:
server min protocol = NT1
Then restart samba:
sudo service smbd restart
sudo service nmbd restart
If you don't do that on the server you will likely get a protocol negotiation failed: error.
That will probably eliminate the SMB1 error message. Whether you can "discover" all the workgroups and hosts in Nautilus is another matter. If you have to turn the clock back to SMB1 days you need to follow the rules set at that era ... name resolve order, host name length restrictions, etc ...
ran into this trying to get an old Netgear Stora to resolve on a unbuntu network
client min protocol = CORE
will get you up and going
20.04 LTS
ps this article may also help you
After a lot of experimentation, in ubuntu 16.04.x this is the solution. Works with Thunar, Nautilus, pcmanfm, Dolphin file managers.
The fix suggested of setting "client max protocol = SMB3_10" in /etc/samba/smb.conf also fixed the problem for me. [1]
Do this in the client ubuntu machine, in addition to the server. This might sound weird but works. [2]
The current Samba version in Ubuntu 16.04 defaults to making NT1 (SMB1) connections even though it supports SMB2 and SMB3 - hence it works when you specify the client version from the command line. The default is scheduled to change to SMB3 in Samba 4.7 (due for release soon) and already does this in LE because we backported the change to Samba 4.6 for our codebase. You have two options:
a) Configure the system smb.conf in Ubuntu to have "client min protocol = smb2" and "client max protocol = smb3" so that smbclient connections are forced to use something higher than NT1 .. then you don't need to specify the protocol version manually.
From debian bug report https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=883939
https://forum.libreelec.tv/thread/9920-solved-8-1-1-samba-access-from-linux-protocol-negotiation-failed/
min protocol = SMB2
NOT
client min protocol = SMB3
Got an extra word in there.
The smpd version 3.6.x doesn't support SMB3, so it won't recognize it. Using max protocol = SMB2 should enable the SMB2 support, so start with it. If you then add min protocol = SMB2 the list gets quite narrow...
The LTS support for Debian 7 "Wheezy" ends on May 31, 2018. That's in less than a week. Upgraded Debian 9 comes with smbd 4.5.x, and SMB 3.0 is supported since smbd 4.2. It will support your max protocol = SMB3.
@Esa Jokinen already answer you, and I think his answer will solve your issue.
Let me give some more details, Here is a link for the explanation on how and what should you do for enable the SMB2 on your Samba (3.6.x). (look for "SMB2 support")
In generally just do the following:
- In the
smb.conf[global] section addmax protocol = SMB2 - Restart your Samba.
I cannot seem to get file sharing/browsing working correctly with Dolphin. Can anyone share the contents of their working smb.conf file so I can see what I'm doing wrong?
I do have kdenetwork-filesharing installed. I use GUFW with UFW and I have samba allowed both in and out. nmblookup does not resolve any of my other PC's names on the network.
Here is testparm. Italics are what I have added in the /etc/samba/smb.conf file trying to get this to work. The rest is what is default in Solus.
[global]
client ipc max protocol = SMB3
client ipc min protocol = SMB2
client max protocol = NT1
client min protocol = SMB2
disable spoolss = Yes
guest account = sambaguest
load printers = No
log file = /var/log/samba/log.%m
map to guest = Bad User
max log size = 500
name resolve order = lmhosts bcast host wins
printcap name = /dev/null
server min protocol = SMB2
server role = standalone server
server string = Samba server (version: %v, protocol: %R)
usershare allow guests = Yes
usershare max shares = 100
usershare path = /var/lib/samba/usershare
idmap config * : backend = tdb
create mask = 0644
hosts allow = 192.168.0.0/16
hosts deny = 0.0.0.0/0
include = /etc/samba/smb.conf
printing = bsd
[homes]
browseable = No
comment = Home Directories
hosts allow =
hosts deny =
include =
lpq command = lpq -P'%p'
lprm command = lprm -P'%p' %j
print command = lpr -r -P'%p' %s
read only = No
[Public]
comment = Public folder share
force create mode = 0755
force group = zsolus
force user = zsolus
guest ok = Yes
path = /home/zsolus/Public
read only = No
The issue here is very simple, Network browsing is using SMBv1!!! In the latest SNIA SDC Microsoft announced about the death of SMBv1(disable by default - register) but still the network browsing will work over SMBv1.
That is why you could not see your device.
Try to modify only the server : server min protocol = SMB2_10
And leave the Client to support SMBv1
Run secpol.msc
I had to disable this here to get mine to work.
My testing with Nessus has indicated SMBv1 is only disabled when setting
min protocol = SMB2
in the [global] section of smb.conf . Core, LANMAN2 and NT1 were all still flagged as being vulnerable.
I had to add this for it to work in my old ubuntu 12-server; with either of min/max-combination SMBv1 is enabled but with both it works fine.
[global]
min protocol = SMB2
max protocol = SMB2
client min protocol = SMB2
client max protocol = SMB2
SLES 11.4 is old enough for its Samba to default to SMBv1 only. You've set both client min protocol and client max protocol, which only affect Samba when it's acting as a client, like smbclient.
For server-side, you've only set server min protocol, so the server max protocol is still defaulting to SMBv1. And because now min protocol is higher than max, smbd actually cannot allow any protocol at all.
The facts that SLES 11.4's Samba is so old and its SMBv3 support seems to be buggy (as you discovered) caused us to make it a priority at work to upgrade any Samba servers that were still running SLES 11.4 to SLES 12 or newer.
running Samba-3.6.3 in SLES 11.4 which has kernel 3.0, my global section is this and I know SMB2 works because windows 10 client will NOT connect via SMB1 the minimum is SMB2 for win10 out of the box.
Note that if you set Min Protocol = SMB2 then if your clients are Windows 7 it will not work for them... at least i did not figure it out troubleshooting on the windows side I think for Win7 it is default SMB1 unless you manually configure something in win7 to say do SMB2.
And for whatever reason setting max protocol = SMB3 caused things not to work for me thus I have SMB2 specified.
[global]
min protocol = SMB2
max protocol = SMB2
workgroup = workgroup
passdb backend = tdbsam
map to guest = Never
usershare allow guests = No
add machine script = /usr/sbin/useradd -c Machine -d /var/lib/nobody -s /bin/false %m$
domain master = No
security = user
wins support = No
server signing = auto
name resolve order = lmhosts bcast host
printing = bsd
printcap name = /dev/null
log level = 2 auth:10 auth_audit:3 auth_json_audit:3 winbind:5
max log size = 1000000
and a sample of a share that i use
[data1]
create mask = 660
directory mask = 770
inherit acls = Yes
path = /data1
read only = No
you should not need to do anything in /etc/fstab other than mounting your storage resource as you normally would. Then once mounted make sure access permissions of that folder... chmod 777 /data1 in my example, are open for starters, then when working go ahead and remove world permissions and change group ownership and permissions as you need.