docs-xml/smbdotconf/security/smbencrypt.xml

   1 <samba:parameter name="smb encrypt"
   2                  context="S"
   3                  type="enum"
   4                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
   5 <description>
   6         <para>
   7         This parameter controls whether a remote client is allowed or required
   8         to use SMB encryption. It has different effects depending on whether
   9         the connection uses SMB1 or SMB2 and newer:
  10         </para>
  11
  12         <itemizedlist>
  13         <listitem>
  14                 <para>
  15                 If the connection uses SMB1, then this option controls the use
  16                 of a Samba-specific extension to the SMB protocol introduced in
  17                 Samba 3.2 that makes use of the Unix extensions.
  18                 </para>
  19         </listitem>
  20
  21         <listitem>
  22                 <para>
  23                 If the connection uses SMB2 or newer, then this option controls
  24                 the use of the SMB-level encryption that is supported in SMB
  25                 version 3.0 and above and available in Windows 8 and newer.
  26                 </para>
  27         </listitem>
  28         </itemizedlist>
  29
  30         <para>
  31                 This parameter can be set globally and on a per-share bases.
  32                 Possible values are
  33                 <emphasis>off</emphasis> (or <emphasis>disabled</emphasis>),
  34                 <emphasis>enabled</emphasis> (or <emphasis>auto</emphasis>, or
  35                 <emphasis>if_required</emphasis>),
  36                 <emphasis>desired</emphasis>,
  37                 and
  38                 <emphasis>required</emphasis>
  39                 (or <emphasis>mandatory</emphasis>).
  40                 A special value is <emphasis>default</emphasis> which is
  41                 the implicit default setting of <emphasis>enabled</emphasis>.
  42         </para>
  43
  44         <variablelist>
  45                 <varlistentry>
  46                 <term><emphasis>Effects for SMB1</emphasis></term>
  47                 <listitem>
  48                 <para>
  49                 The Samba-specific encryption of SMB1 connections is an
  50                 extension to the SMB protocol negotiated as part of the UNIX
  51                 extensions.  SMB encryption uses the GSSAPI (SSPI on Windows)
  52                 ability to encrypt and sign every request/response in a SMB
  53                 protocol stream. When enabled it provides a secure method of
  54                 SMB/CIFS communication, similar to an ssh protected session, but
  55                 using SMB/CIFS authentication to negotiate encryption and
  56                 signing keys. Currently this is only supported smbclient of by
  57                 Samba 3.2 and newer, and hopefully soon Linux CIFSFS and MacOS/X
  58                 clients. Windows clients do not support this feature.
  59                 </para>
  60
  61                 <para>This may be set on a per-share
  62                 basis, but clients may chose to encrypt the entire session, not
  63                 just traffic to a specific share. If this is set to mandatory
  64                 then all traffic to a share <emphasis>must</emphasis>
  65                 be encrypted once the connection has been made to the share.
  66                 The server would return "access denied" to all non-encrypted
  67                 requests on such a share. Selecting encrypted traffic reduces
  68                 throughput as smaller packet sizes must be used (no huge UNIX
  69                 style read/writes allowed) as well as the overhead of encrypting
  70                 and signing all the data.
  71                 </para>
  72
  73                 <para>
  74                 If SMB encryption is selected, Windows style SMB signing (see
  75                 the <smbconfoption name="server signing"/> option) is no longer
  76                 necessary, as the GSSAPI flags use select both signing and
  77                 sealing of the data.
  78                 </para>
  79
  80                 <para>
  81                 When set to auto or default, SMB encryption is offered, but not
  82                 enforced.  When set to mandatory, SMB encryption is required and
  83                 if set to disabled, SMB encryption can not be negotiated.
  84                 </para>
  85                 </listitem>
  86                 </varlistentry>
  87
  88                 <varlistentry>
  89                 <term><emphasis>Effects for SMB2</emphasis></term>
  90                 <listitem>
  91                 <para>
  92                 Native SMB transport encryption is available in SMB version 3.0
  93                 or newer. It is only offered by Samba if
  94                 <emphasis>server max protocol</emphasis> is set to
  95                 <emphasis>SMB3</emphasis> or newer.
  96                 Clients supporting this type of encryption include
  97                 Windows 8 and newer,
  98                 Windows server 2012 and newer,
  99                 and smbclient of Samba 4.1 and newer.
 100                 </para>
 101
 102                 <para>
 103                 The protocol implementation offers various options:
 104                 </para>
 105
 106                 <itemizedlist>
 107                         <listitem>
 108                         <para>
 109                         The capability to perform SMB encryption can be
 110                         negotiated during protocol negotiation.
 111                         </para>
 112                         </listitem>
 113
 114                         <listitem>
 115                         <para>
 116                         Data encryption can be enabled globally. In that case,
 117                         an encryption-capable connection will have all traffic
 118                         in all its sessions encrypted. In particular all share
 119                         connections will be encrypted.
 120                         </para>
 121                         </listitem>
 122
 123                         <listitem>
 124                         <para>
 125                         Data encryption can also be enabled per share if not
 126                         enabled globally. For an encryption-capable connection,
 127                         all connections to an encryption-enabled share will be
 128                         encrypted.
 129                         </para>
 130                         </listitem>
 131
 132                         <listitem>
 133                         <para>
 134                         Encryption can be enforced. This means that session
 135                         setups will be denied on non-encryption-capable
 136                         connections if data encryption has been enabled
 137                         globally. And tree connections will be denied for
 138                         non-encryption capable connections to shares with data
 139                         encryption enabled.
 140                         </para>
 141                         </listitem>
 142                 </itemizedlist>
 143
 144                 <para>
 145                 These features can be controlled with settings of
 146                 <emphasis>smb encrypt</emphasis> as follows:
 147                 </para>
 148
 149                 <itemizedlist>
 150                         <listitem>
 151                         <para>
 152                         Leaving it as default, explicitly setting
 153                         <emphasis>default</emphasis>, or setting it to
 154                         <emphasis>enabled</emphasis> globally will enable
 155                         negotiation of encryption but will not turn on
 156                         data encryption globally or per share.
 157                         </para>
 158                         </listitem>
 159
 160                         <listitem>
 161                         <para>
 162                         Setting it to <emphasis>desired</emphasis> globally
 163                         will enable negotiation and will turn on data encryption
 164                         on sessions and share connections for those clients
 165                         that support it.
 166                         </para>
 167                         </listitem>
 168
 169                         <listitem>
 170                         <para>
 171                         Setting it to <emphasis>required</emphasis> globally
 172                         will enable negotiation and turn on data encryption
 173                         on sessions and share connections. Clients that do
 174                         not support encryption will be denied access to the
 175                         server.
 176                         </para>
 177                         </listitem>
 178
 179                         <listitem>
 180                         <para>
 181                         Setting it to <emphasis>off</emphasis> globally will
 182                         completely disable the encryption feature.
 183                         </para>
 184                         </listitem>
 185
 186                         <listitem>
 187                         <para>
 188                         Setting it to <emphasis>desired</emphasis> on a share
 189                         will turn on data encryption for this share for clients
 190                         that support encryption if negotiation has been
 191                         enabled globally.
 192                         </para>
 193                         </listitem>
 194
 195                         <listitem>
 196                         <para>
 197                         Setting it to <emphasis>required</emphasis> on a share
 198                         will enforce data encryption for this share if
 199                         negotiation has been enabled globally. I.e. clients that
 200                         do not support encryption will be denied access to the
 201                         share.
 202                         </para>
 203                         <para>
 204                         Note that this allows per-share enforcing to be
 205                         controlled in Samba differently from Windows:
 206                         In Windows, <emphasis>RejectUnencryptedAccess</emphasis>
 207                         is a global setting, and if it is set, all shares with
 208                         data encryption turned on
 209                         are automatically enforcing encryption. In order to
 210                         achieve the same effect in Samba, one
 211                         has to globally set <emphasis>smb encrypt</emphasis> to
 212                         <emphasis>enabled</emphasis>, and then set all shares
 213                         that should be encrypted to
 214                         <emphasis>required</emphasis>.
 215                         Additionally, it is possible in Samba to have some
 216                         shares with encryption <emphasis>required</emphasis>
 217                         and some other shares with encryption only
 218                         <emphasis>desired</emphasis>, which is not possible in
 219                         Windows.
 220                         </para>
 221                         </listitem>
 222
 223                         <listitem>
 224                         <para>
 225                         Setting it to <emphasis>off</emphasis> or
 226                         <emphasis>enabled</emphasis> for a share has
 227                         no effect.
 228                         </para>
 229                         </listitem>
 230                 </itemizedlist>
 231                 </listitem>
 232                 </varlistentry>
 233         </variablelist>
 234 </description>
 235
 236 <value type="default">default</value>
 237 </samba:parameter>