Hi everyone,

I’m new to unRAID and homelabbing. I just performed a fresh install of Unraid 7.3 (Samba 4.22.10) and am attempting to harden my Samba configuration before storing any data.

I entered a comprehensive security configuration into the Settings > SMB > SMB Extra Configuration field. However, upon verifying with testparm -s, several critical security settings are either missing entirely or reverted to insecure defaults.

I suspect this is due to how unRAID merges the default template with the smb-extra.conf file, but honestly I am unsure how to force my overrides to take precedence.

My Configuration (Input via SMB Web UI)

[global]
smb encrypt = required
server signing = required
client signing = required
client ipc signing = required
server min protocol = SMB3_11
client min protocol = SMB3_11
passdb backend = tdbsam
ntlm auth = disabled
restrict anonymous = 2
map to guest = Never 
invalid users = root
create mask = 0640
force create mode = 0640
directory mask = 0750
force directory mode = 0750
follow symlinks = No
wide links = No
bind interfaces only = Yes
interfaces = ***************
disable netbios = Yes
use sendfile = Yes
aio read size = 4096
aio write size = 4096
vfs objects = full_audit
full_audit:prefix = %u|%I|%m|%S
full_audit:success = connect disconnect open close read write
full_audit:failure = connect
logging = syslog@0
log level = 2
idmap config * : backend = tdb
idmap config * : range = 3000-7999

The Output (testparm -s)

Load smb config files from /etc/samba/smb.conf
lpcfg_do_global_parameter: WARNING: The "null passwords" option is deprecated 		<-- smb.conf 
Loaded services file OK.
Weak crypto is allowed by GnuTLS (e.g. NTLM as a compatibility fallback)	<-- smb.conf? cause for concern?

Server role: ROLE_STANDALONE

# Global parameters
[global]
        bind interfaces only = Yes
        client ipc signing = required
        client min protocol = SMB3			<-- Expected: SMB3_11 (although could just be formating)
        client signing = required
        disable netbios = Yes
        disable spoolss = Yes
        interfaces = *************
        load printers = No
        logging = syslog@0
        max open files = 40960
        multicast dns register = No
        ntlm auth = disabled				<-- Working
        null passwords = Yes				<-- CRITICAL: Should be No/Disabled	
        printcap name = /dev/null
        restrict anonymous = 2				<-- Working
        security = USER
        server min protocol = SMB3  		<-- Expected: SMB3_11
        server signing = required 			<-- Working
        server string = Media server
        show add printer wizard = No
        smb1 unix extensions = No
        smb3 directory leases = No
        full_audit:failure = connect
        full_audit:success = connect disconnect open close read write
        full_audit:prefix = %u|%I|%m|%S
        fruit:nfs_aces = No
        idmap config * : range = 3000-7999
        idmap config * : backend = tdb
        acl allow execute always = Yes
        aio read size = 4096
        aio write size = 4096
        create mask = 0640
        directory mask = 0750
        follow symlinks = No
        force create mode = 0640
        force directory mode = 0750
        include = /etc/samba/smb-shares.conf
        invalid users = root
        use sendfile = Yes
        vfs objects = full_audit

Critical Issues Identified

1. smb encrypt = required is MISSING: This line does not appear in the output at all. Encryption is likely not enforced.

2. null passwords = Yes: Despite my efforts, this remains Yes. The warning "deprecated" suggests it's being ignored or overridden.

3. Protocol Downgrade: server min protocol shows as SMB3 instead of SMB3_11.

4. map to guest ignored: The output shows map to guest = Bad User (default), ignoring my Never setting.

Any advice on how to force these overrides would be greatly appreciated!

Thanks,
ChaoticTea

Edited August 19Aug 19 by ChaoticTea
added more details, and fix format

I think you might have a problem with these settings:

The explanation is below:

https://forums.unraid.net/topic/191221-some-musings-on-smb-and-samba-and-unraid-and-windows/#findComment-1561580

These permissions may work depending your user setup for file access. However the default settings of 777 and 666 will work if you set the Unraid SMB file sharing to 'Private' and setup the permissions fos all of the Share Access users to restrict them as required by your security requirements. (The problem with the default permissions is if you permit NFS access via networking or a VM. Or Docker Container access via Linux. But the Unraid Linux default permissions are not controlled by the SMB settings...)

Hi Frank1940,

Thanks for getting back to me so fast, it is deeply appreciated!

38 minutes ago, Frank1940 said:

These permissions may work depending your user setup for file access. However the default settings of 777 and 666 will work if you set the Unraid SMB file sharing to 'Private' and setup the permissions fos all of the Share Access users to restrict them as required by your security requirements.

From understanding of what you are saying, is that I don't need to include:

# webui smb-extra.conf
create mask = 0640
force create mode = 0640
directory mask = 0750
force directory mode = 0750

In my extra.conf, because it is handled by the shares user permission? Which would make sense. XD

I have now removed it from my WebUI smb-extra.conf file, however this still doesn't resolve the other issues with SMB defaults template file overriding my security/hardening setup. How would I navigate that, making my changes permanent and not overridden by what i think is the smb.conf file?

Thanks,
ChaoticTea

One more post for you:

https://forums.unraid.net/topic/170027-smb-windows-settings-available-through-power-shell-and-linux-samba-tools-informational-posting/#findComment-1545332

Note the smbstatus command. It will show the actual protocol being used. See below:

EDIT: Here is my Samba extras configuration. Note that I have set the min protocol to SMB2 but the client/server negotiation has set it to SMB3_11

# max protocol = SMB2_02

[global]

server signing = auto

case sensitive = true

map to guest = Never

# acl allow execute always = no

# create mask = 0666

map archive = no

# store dos attributes = no

# server min protocol = NT1

server min protocol = SMB2

Note that I have set the min protocol to SMB2 but the client/server negotiation has set it to SMB3_11 Remember that not everything is dependent of the server side settings. (In fact, more thing fail for the Windows side to prevent connections than on the Unraid side.)

Edited August 19Aug 19 by Frank1940

Thanks for help and the quick response again!

I've put your extra-config into for comparison and it does work!

[global]
server signing = auto
case sensitive = true
map to guest = Never
# acl allow execute always = no
# create mask = 0666
map archive = no
# store dos attributes = no
# server min protocol = NT1
server min protocol = SMB2

I can successfully connect, and it successfully executes:

~# smbsatus 
Samba version 4.22.10
PID     Username     Group        Machine                                   Protocol Version  Encryption           Signing              
----------------------------------------------------------------------------------------------------------------------------------------
82444   tea XD        users        *******************						 SMB3_11           -             partial(AES-128-GMAC)

Service      pid     Machine       Connected at                     Encryption   Signing     
---------------------------------------------------------------------------------------------
IPC$         82444  **************  Wed Aug 19 07:00:05 PM 2026 UTC  -            -           

No locked files

========================================

~#testparm
oad smb config files from /etc/samba/smb.conf
lpcfg_do_global_parameter: WARNING: The "null passwords" option is deprecated 			<--
Loaded services file OK.
Weak crypto is allowed by GnuTLS (e.g. NTLM as a compatibility fallback)				<--

Server role: ROLE_STANDALONE

Press enter to see a dump of your service definitions

# Global parameters
[global]
        bind interfaces only = Yes
        disable netbios = Yes
        disable spoolss = Yes
        interfaces = ***************************
        load printers = No
        logging = syslog@0
        max open files = 40960
        multicast dns register = No
        ntlm auth = ntlmv1-permitted
        null passwords = Yes
        passdb backend = smbpasswd
        printcap name = /dev/null
        security = USER
        server min protocol = SMB2
        server signing = if_required
        server string = Media server
        show add printer wizard = No
        smb1 unix extensions = No
        smb3 directory leases = No
        fruit:nfs_aces = No
        idmap config * : range = 3000-7999
        idmap config * : backend = tdb
        acl allow execute always = Yes
        aio read size = 0
        aio write size = 0
        case sensitive = Yes
        create mask = 0777
        directory mask = 0777
        include = /etc/samba/smb-shares.conf
        invalid users = root
        map archive = No
        use sendfile = Yes
        wide links = Yes

However this leaves the system vulnerable to whole host of vulnerabilities and exploits which I'm trying to mitigate against.

And it still doesn't really apply them:

┌───────────────────────┬──────────────┬───────────────────────┐
│ Setting               │ I Wrote      │ Actually Applied      │
├───────────────────────┼──────────────┼───────────────────────┤
│ server signing        │ auto         │ if_required           │
│ server min protocol   │ SMB2         │ SMB2 (formating ?)    │
│ map to guest          │ Never        │ Not shown (may work)  │
│ null passwords        │ N/A          │ Yes (CRITICAL BUG)    │
└───────────────────────┴──────────────┴───────────────────────┘

Is this because of how smb.conf works in unRaid and how it applies the changes specified in smb-extra.conf AFTER the initial template file, which end up competing on which settings to use?

Thanks,
ChaoticTea

The default testparm shows only that Samba parameters which have been changed from the SMB defaults.

You run it with the -v switch, it will show all of the samba parameters and their settings.

testparm -v

Be prepared as it will hundreds of lines long. Here is the configuration information webpage for smb.conf:

https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html

The server min protocol = SMB2 is a leftover from many years when I was blocking SMBv1 from running. As I recall, Windows will now block any connection that does not use SMB3_11 protocol.

I can' understand why anyone who has the least possible interest in security would even consider using null passwords = Yes The default has been null passwords = No for years!

Server signing– the Samba documentation on this topic has this:

The 'if required' is not even an option in the description. MS has made changes in the Windows SMB client recently to require signing and I suspect that Samba has had some changes in way this parameter works but those changes apparently have not made it into the docs. But if you think about it, 'if required' is quite similar to what would be expected with 'auto'.

Just noticed this— you have a user name that does not meet Unraid requirements (space in the user name and upper case letters) for creating user names:

Here is the help from the "Add user" page:

I am not completely sure why a space and upper case letters after the initial starting lower case letter are not permitted but I want to alert you to it.