put in the [global] section of /etc/samba/smb.conf the directive

min protocol = NT1

samba calls SMB1 as NT1.

The smb-protocols nmap script checks to see which smb dialects are present on the Samba server.

client min protocol sets the minimum smb dialect that server can use to connect to another server not the minimum dialects that a client to this server can use.

By default the version of samba used in Ubuntu 18.04 sets the server min to NT1 ( smbv1 ) and the max to SMBv3.

If you want to restrict access to this server to SMB3 and SMB3 only you need to set the server min protocol:

server min protocol = SMB3

*Note: there are sub-variants to this dialect:

SMB3_00: Windows 8

SMB3_02: Windows 8.1

SMB3_10: early Windows 10

SMB3_11: Windows 10

By default SMB3 in smb.conf selects the SMB3_11 variant.*

Do you mean NTLM v1 authentication (ntlm auth = yes alias ntlm auth = ntlmv1-permitted) or SMB protocol v1 (server min protocol = NT1)? With a new enough version of Samba, you might need both of these settings.

(Modern defaults e.g. in Debian 11 are ntlm-auth = ntlmv2-only and server min protocol = SMB2_02.)

Unfortunately both of them are marked with (G) in the smb.conf(5) man page, indicating that these settings can only be specified in the [global] section of the configuration. This is probably because these settings affect the conversation between the client and the server even before the client can tell the server which share it wants to access.

Since the weakness of the SMBv1 protocol was the reason why the WannaCry ransomware managed to spread so fast and wide, the attitude towards it among security-aware administrators these days tends to be "kill SMBv1 with fire". You might want to e.g. set up a virtual machine, with a stand-alone Samba server dedicated to serving that old scanner and any other SMBv1 devices like that only.

If you want maximum security, you would then have any scanned documents first pass through an anti-virus check before transferring them to a share in another system that will be accessible using SMBv2 or greater, on the assumption that a malicious user might use the scanner's network connection to plug in a malware injector.

Disclaimer

The SMBv1 protocol is from the 1983, it is unsecure and thus disabled for a good reason. The SMBv2 protocol has been available since 2006.

Problem Description

I arrived at this question trying to find a solution for the following two problems:

1. I have an HP printer that can only use the legacy SMBv1 protocol (HP OfficeJet Pro 8620). So my printer refused to connect to the network share and the scan to network feature stopped working.

2. I tried to use Nautilus to browse the network shares on my own Ubuntu system. And I was getting an error with the message Unable to access location Failed to retrieve share list from server: Invalid Argument:

   

Solution

After several attempts with different values in the /etc/samba/smb.conf file I was finally able to resolve these problems using these two values:

client min protocol = NT1
server min protocol = NT1

I also found posts that suggested to add this third parameter:

ntlm auth = ntlmv1-permitted

However, on my system this was not necessary.

Explanation

As I understand it, the client min protocol option controls how your system communicates with other SMB servers, changing this option could be useful if your Ubuntu system works as a client and you want to use SMBv1 to access a server. By default (with Samba 4.11) your local Samba installation is configured to require SMBv2 or higher connections.

On the other hand, if your Ubuntu system acts as the server that requires SMBv2 or higher and you have a remote client (such as a printer) that can only understand the legacy SMBv1 protocol, then it seems that changing the client min protocol has no effect. Instead you need to change the server min protocol. This way the client can negotiate SMBv1 with the Samba daemon running on your Ubuntu system.

Side note, you can also pass the client min protocol option to tools such as smbclient, for example:

smbclient -L //<hostname>/<folder> --option='client min protocol=NT1'

Can be used to set the client protocol to SMBv1. This was useful to test the effect of changes in the smb.conf file.

I tried this on Ubuntu 20.04 which comes with samba version 4.11. I have not tested this solution on older Ubuntu distributions.