Learn Samba - SMB Hardening

#Introduction

The firewall in episode 13 secured the entrance; now we harden the server itself. SMB hardening means closing the fragile legacy features, requiring modern security mechanisms, and building an audit so suspicious behavior becomes visible. The goal: a configuration that, if audited by a pentester or SOC, produces no major findings.

#Disabling SMB1 and Weak Dialects

#server min protocol

SMB1 has been disabled by default since Samba 4.11 (episode 2), but you should assert and document it so it doesn't silently shift:

[global]
   server min protocol = SMB2_10
   server max protocol = SMB3_11

server min protocol = SMB2_10 rejects clients below SMB2.1. Don't choose SMB1 or NT1 under any circumstances — every dialect below SMB2 carries an unjustifiable attack surface. For environments with only modern clients, SMB3 (not SMB3_11) is also a valid, stricter option.

#Authentication: ntlm auth

#NTLM vs Kerberos

NTLM is a legacy authentication protocol vulnerable to pass-the-hash and relay attacks (we can dampen relay with signing, but not all of it). Kerberos is the modern standard in AD domains. The parameter:

[global]
   ntlm auth = no
   lanman auth = no

• ntlm auth = no: reject NTLM authentication — clients must use Kerberos. Consequence: legacy devices/consoles that don't support Kerberos will fail to log in.
• lanman auth = no: reject the even weaker LM hashes — this is almost always safe to turn off.

#When "no" Can Be Applied

ntlm auth = no can't be applied blindly:

• On an AD DC, NTLM is sometimes still needed for certain scenarios (some line-of-business apps, legacy Windows) — evaluate with an audit first.
• On a member/standalone with all-modern clients (Windows 10+, macOS, Linux), no is generally safe.
• Use logs to find NTLM users before turning it off (the audit section below) — the detect → assess → enforce approach.

#Required Signing and Encryption

#Server Signing

Signing protects integrity and dampens SMB relay attacks (protocol smuggling). In Samba:

[global]
   server signing = required
   smb encrypt = required

server signing = required + smb encrypt = required is the hardest combination: every connection is signed and encrypted. Trade-offs: extra CPU load (minimal on modern CPUs with AES-NI) and compatibility — legacy devices without SMB3 encryption support will be rejected. For a modern production baseline, that's a fair price.

1. server min protocol = SMB2_10   (matikan SMB1)
2. lanman auth = no                (matikan LM hash)
3. server signing = required       (cegah relay)
4. smb encrypt = required          (enkripsi wire)
5. ntlm auth = no                  (Kerberos only, bila aman)

#Audit: smbstatus and Logs

#smbstatus: See Who's Connected

smbstatus is a window into active connections — make it a habit:

smbstatus
smbstatus -b      # detail per user/klien
smbstatus -L      # share yang sedang diakses

smbstatus -b shows user, origin host, IP, and protocol. You'll immediately see strange connections (e.g. a foreign IP at unusual working hours) — this is the cheapest real-time audit.

#Log Level and Authentication Audit

log level controls log verbosity. Default 1 (errors only); for troubleshooting we use 3 (episode 16). For an authentication audit, enable a dedicated log:

[global]
   log level = 1 auth_audit:2
   log file = /var/log/samba/log.%m
   max log size = 1024

log level = 1 auth_audit:2 raises verbosity only for the auth_audit category — you get successful/failed login records without being flooded by whole-system logs. Check:

sudo grep -i "NT_STATUS" /var/log/samba/*.log
sudo journalctl -u smbd | grep -iE "(failed|denied|authenticat)"

NT_STATUS_LOGON_FAILURE is a sign of failed login attempts — if the frequency is high from one IP, that's a brute-force signal to act on (episode 15).

#Full Hardening Baseline

The minimum hardening set for a modern file server:

[global]
   security = user
   map to guest = never
   server min protocol = SMB2_10
   server max protocol = SMB3_11
   ntlm auth = no
   lanman auth = no
   server signing = required
   smb encrypt = required
   log level = 1 auth_audit:2
   log file = /var/log/samba/log.%m
   max log size = 1024

Validate after all changes: testparm then smbcontrol all reload-config (episode 3). For an AD DC, adjust: ntlm auth = no can break apps still on NTLM — apply it after an audit.

#Common Pitfalls

• Server unreachable after smb encrypt = required: there are clients without encryption support — use desired first while auditing, then move up to required.
• Signing/encryption "required" but clients still connect plain: check smbstatus -b — if the protocol is SMB3_11 but without enc/signing, there's an override at the share level.
• Total outage after ntlm auth = no: legacy devices connect with NTLM — restrict them to a separate VLAN or allow NTLM only for specific accounts via a per-allowlist ntlm auth.

#Closing

Key takeaways:

• server min protocol = SMB2_10 closes SMB1 and all fragile dialects below it.
• ntlm auth = no and lanman auth = no remove legacy authentication protocols — apply after an audit.
• server signing = required + smb encrypt = required is the modern connection baseline.
• smbstatus is real-time auditing; auth_audit in log level records login events.
• Apply gradually: detect → assess → enforce, don't go "all hard at once".

In episode 15 next, we'll cover privilege & ransomware mitigation — immutable snapshots, read-only shares for backup targets, recycle as a safety net, monitoring suspicious access, plus least privilege and share segregation best practices. Your server will be prepared for the worst-case scenario!