ChaoticTea

Thanks for help and the quick response again! I've put your extra-config into for comparison and it does work! [global] server signing = auto case sensitive = true map to guest = Never # acl allow execute always = no # create mask = 0666 map archive = no # store dos attributes = no # server min protocol = NT1 server min protocol = SMB2I can successfully connect, and it successfully executes: ~# smbsatus Samba version 4.22.10 PID Username Group Machine Protocol Version Encryption Signing ---------------------------------------------------------------------------------------------------------------------------------------- 82444 tea XD users ******************* SMB3_11 - partial(AES-128-GMAC) Service pid Machine Connected at Encryption Signing --------------------------------------------------------------------------------------------- IPC$ 82444 ************** Wed Aug 19 07:00:05 PM 2026 UTC - - No locked files ======================================== ~#testparm oad smb config files from /etc/samba/smb.conf lpcfg_do_global_parameter: WARNING: The "null passwords" option is deprecated <-- Loaded services file OK. Weak crypto is allowed by GnuTLS (e.g. NTLM as a compatibility fallback) <-- Server role: ROLE_STANDALONE Press enter to see a dump of your service definitions # Global parameters [global] bind interfaces only = Yes disable netbios = Yes disable spoolss = Yes interfaces = *************************** load printers = No logging = syslog@0 max open files = 40960 multicast dns register = No ntlm auth = ntlmv1-permitted null passwords = Yes passdb backend = smbpasswd printcap name = /dev/null security = USER server min protocol = SMB2 server signing = if_required server string = Media server show add printer wizard = No smb1 unix extensions = No smb3 directory leases = No fruit:nfs_aces = No idmap config * : range = 3000-7999 idmap config * : backend = tdb acl allow execute always = Yes aio read size = 0 aio write size = 0 case sensitive = Yes create mask = 0777 directory mask = 0777 include = /etc/samba/smb-shares.conf invalid users = root map archive = No use sendfile = Yes wide links = YesHowever this leaves the system vulnerable to whole host of vulnerabilities and exploits which I'm trying to mitigate against. And it still doesn't really apply them: ┌───────────────────────┬──────────────┬───────────────────────┐ │ Setting │ I Wrote │ Actually Applied │ ├───────────────────────┼──────────────┼───────────────────────┤ │ server signing │ auto │ if_required │ │ server min protocol │ SMB2 │ SMB2 (formating ?) │ │ map to guest │ Never │ Not shown (may work) │ │ null passwords │ N/A │ Yes (CRITICAL BUG) │ └───────────────────────┴──────────────┴───────────────────────┘Is this because of how smb.conf works in unRaid and how it applies the changes specified in smb-extra.conf AFTER the initial template file, which end up competing on which settings to use? Thanks, ChaoticTea

Hi Frank1940, Thanks for getting back to me so fast, it is deeply appreciated! From understanding of what you are saying, is that I don't need to include: # webui smb-extra.conf create mask = 0640 force create mode = 0640 directory mask = 0750 force directory mode = 0750 In my extra.conf, because it is handled by the shares user permission? Which would make sense. XD I have now removed it from my WebUI smb-extra.conf file, however this still doesn't resolve the other issues with SMB defaults template file overriding my security/hardening setup. How would I navigate that, making my changes permanent and not overridden by what i think is the smb.conf file? Thanks, ChaoticTea

Hi everyone, I’m new to unRAID and homelabbing. I just performed a fresh install of Unraid 7.3 (Samba 4.22.10) and am attempting to harden my Samba configuration before storing any data. I entered a comprehensive security configuration into the Settings > SMB > SMB Extra Configuration field. However, upon verifying with testparm -s, several critical security settings are either missing entirely or reverted to insecure defaults. I suspect this is due to how unRAID merges the default template with the smb-extra.conf file, but honestly I am unsure how to force my overrides to take precedence. My Configuration (Input via SMB Web UI) [global] smb encrypt = required server signing = required client signing = required client ipc signing = required server min protocol = SMB3_11 client min protocol = SMB3_11 passdb backend = tdbsam ntlm auth = disabled restrict anonymous = 2 map to guest = Never invalid users = root create mask = 0640 force create mode = 0640 directory mask = 0750 force directory mode = 0750 follow symlinks = No wide links = No bind interfaces only = Yes interfaces = *************** disable netbios = Yes use sendfile = Yes aio read size = 4096 aio write size = 4096 vfs objects = full_audit full_audit:prefix = %u|%I|%m|%S full_audit:success = connect disconnect open close read write full_audit:failure = connect logging = syslog@0 log level = 2 idmap config * : backend = tdb idmap config * : range = 3000-7999 The Output (testparm -s) Load smb config files from /etc/samba/smb.conf lpcfg_do_global_parameter: WARNING: The "null passwords" option is deprecated <-- smb.conf Loaded services file OK. Weak crypto is allowed by GnuTLS (e.g. NTLM as a compatibility fallback) <-- smb.conf? cause for concern? Server role: ROLE_STANDALONE # Global parameters [global] bind interfaces only = Yes client ipc signing = required client min protocol = SMB3 <-- Expected: SMB3_11 (although could just be formating) client signing = required disable netbios = Yes disable spoolss = Yes interfaces = ************* load printers = No logging = syslog@0 max open files = 40960 multicast dns register = No ntlm auth = disabled <-- Working null passwords = Yes <-- CRITICAL: Should be No/Disabled printcap name = /dev/null restrict anonymous = 2 <-- Working security = USER server min protocol = SMB3 <-- Expected: SMB3_11 server signing = required <-- Working server string = Media server show add printer wizard = No smb1 unix extensions = No smb3 directory leases = No full_audit:failure = connect full_audit:success = connect disconnect open close read write full_audit:prefix = %u|%I|%m|%S fruit:nfs_aces = No idmap config * : range = 3000-7999 idmap config * : backend = tdb acl allow execute always = Yes aio read size = 4096 aio write size = 4096 create mask = 0640 directory mask = 0750 follow symlinks = No force create mode = 0640 force directory mode = 0750 include = /etc/samba/smb-shares.conf invalid users = root use sendfile = Yes vfs objects = full_audit Critical Issues Identified smb encrypt = required is MISSING: This line does not appear in the output at all. Encryption is likely not enforced. null passwords = Yes: Despite my efforts, this remains Yes. The warning "deprecated" suggests it's being ignored or overridden. Protocol Downgrade: server min protocol shows as SMB3 instead of SMB3_11. map to guest ignored: The output shows map to guest = Bad User (default), ignoring my Never setting. Any advice on how to force these overrides would be greatly appreciated! Thanks, ChaoticTea