Content deleted Content added
Reverted 1 edit by 173.63.206.97 (talk): SMB doesn't redirect here |
changed NFS to SMB for Likewise |
||
| (31 intermediate revisions by 23 users not shown) | |||
Line 1:
{{Short description|Network communication protocol for providing shared access to resources}}
[[File:Map Network Drive.PNG|thumb|Map Network Drive dialog in Windows 10, connecting to a local SMB network drive]]
'''Server Message Block''' ('''SMB''') is a [[communication protocol]]<ref>{{cite web|url=http://msdn.microsoft.com/en-us/library/aa365233(VS.85).aspx|title=Microsoft SMB Protocol and CIFS Protocol Overview|publisher=[[Microsoft]]|date=October 22, 2009|access-date=April 10, 2019|archive-url=https://web.archive.org/web/20160802013033/https://msdn.microsoft.com/en-us/library/aa365233(vs.85).aspx|archive-date=August 2, 2016|url-status=live}}</ref>
SMB was originally developed in 1983 by Barry A. Feigenbaum at IBM<ref name="tridgemyths" />
In 1996, Microsoft published a version of SMB 1.0<ref name=":2" /> with minor modifications under the '''Common Internet File System''' ('''CIFS''' {{IPAc-en|s|ɪ|f|s}}) moniker. CIFS was compatible with even the earliest incarnation of SMB, including [[LAN Manager]]'s.<ref name=":2" /> It supports symbolic links, hard links, and larger file size, but none of the features of SMB 2.0 and later.<ref name=":2">{{cite web|date=18 July 2012|title=Common Internet File System|url=https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc939973(v=technet.10)|website=Windows 2000 Web and Application Services Technical Overview|publisher=Microsoft|via=[[Microsoft Docs]]|access-date=30 January 2022|archive-date=30 January 2022|archive-url=https://web.archive.org/web/20220130134645/https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc939973(v=technet.10)|url-status=live}}</ref><ref>{{cite web|last1=Coulter|first1=David|last2=Satran|first2=Michael|last3=Batchelor|first3=Drew|date=8 January 2021|title=Microsoft SMB Protocol and CIFS Protocol Overview|url=https://docs.microsoft.com/en-us/windows/win32/fileio/microsoft-smb-protocol-and-cifs-protocol-overview|website=Windows App Development|publisher=[[Microsoft]]|via=[[Microsoft Docs]]|access-date=30 January 2022|archive-date=28 January 2022|archive-url=https://web.archive.org/web/20220128051636/https://docs.microsoft.com/en-us/windows/win32/fileio/microsoft-smb-protocol-and-cifs-protocol-overview|url-status=live}}</ref> Microsoft's proposal, however, remained an [[Internet Draft]] and never achieved standard status.<ref name="IETF" /> Microsoft has since discontinued
== Features ==
Line 14:
In Microsoft Windows, two vaguely named [[Windows service]]s implement SMB. The "Server" service (ID: <code>LanmanServer</code>) is in charge of serving [[shared resource]]s. The "Workstation" service (ID: <code>LanmanWorkstation</code>) maintains the computer name and helps access shared resources on other computers.<ref name=":0" /> SMB uses the [[Kerberos (protocol)|Kerberos]] protocol to authenticate users against [[Active Directory]] on [[Windows ___domain]] networks. On simpler, peer-to-peer networks, SMB uses the [[NTLM]] protocol.
[[Windows NT 4.0|Windows NT 4.0 SP3]] and later can [[Digital signature|digitally sign]] SMB messages to prevent some [[man-in-the-middle attack]]s.<ref>{{cite web|date=24 November 2021|title=Overview of Server Message Block signing|url=https://docs.microsoft.com/en-US/troubleshoot/windows-server/networking/overview-server-message-block-signing|website=Windows Server troubleshooting|publisher=[[Microsoft]]|via=[[Microsoft Docs]]|access-date=29 January 2022|archive-date=29 January 2022|archive-url=https://web.archive.org/web/20220129191652/https://docs.microsoft.com/en-US/troubleshoot/windows-server/networking/overview-server-message-block-signing|url-status=live}}</ref><ref name=":1">{{cite web|author=Johansson|first=Jesper M.|date=20 May 2005|title=How to Shoot Yourself in the Foot with Security, Part 1|url=https://docs.microsoft.com/en-us/previous-versions/tn-archive/cc512612(v=technet.10)|website=Security Guidance|publisher=[[Microsoft]]|via=[[Microsoft Docs]]|quote=This article addresses [...] Server Message Block (SMB) message signing.|access-date=19 October 2018|archive-date=19 October 2018|archive-url=https://web.archive.org/web/20181019041254/https://docs.microsoft.com/en-us/previous-versions/tn-archive/cc512612(v=technet.10)|url-status=live}}</ref><ref>{{cite web|author=Barreto|first=Jose|date=1 December 2010|title=The Basics of SMB Signing (covering both SMB1 and SMB2)|url=https://docs.microsoft.com/en-us/archive/blogs/josebda/the-basics-of-smb-signing-covering-both-smb1-and-smb2|url-status=live|archive-url=https://web.archive.org/web/20121202155239/http://blogs.technet.com/b/josebda/archive/2010/12/01/the-basics-of-smb-signing-covering-both-smb1-and-smb2.aspx|archive-date=2 December 2012|website=Jose Barreto's Blog Archive|publisher=[[Microsoft]]|via=[[Microsoft Docs]]|quote=This security mechanism in the SMB protocol helps avoid issues like tampering of packets and "man in the middle" attacks. [...] SMB signing is available in all currently supported versions of Windows, but it’s only enabled by default on Domain Controllers. This is recommended for Domain Controllers because SMB is the protocol used by clients to download Group Policy information. SMB signing provides a way to ensure that the client is receiving genuine Group Policy.}}</ref> SMB signing may be configured individually for incoming SMB connections (by the "LanmanServer" service) and outgoing SMB connections (by the "LanmanWorkstation" service). The default setting for Windows [[___domain controller]]s running [[Windows Server 2003]] and later is to not allow unsigned incoming connections.<ref>{{cite web | url = http://support.microsoft.com/kb/887429 | title = MSKB887429: Overview of Server Message Block signing | publisher = [[Microsoft]] | date = November 30, 2007 | quote = By default, SMB signing is required for incoming SMB sessions on Windows Server 2003-based ___domain controllers. | access-date = October 24, 2012 | archive-url = https://web.archive.org/web/20101120173639/http://support.microsoft.com/kb/887429 | archive-date = November 20, 2010 | url-status = live }}</ref> As such, earlier versions of Windows that do not support SMB signing from the get-go (including [[Windows 9x]]) cannot connect to a Windows Server 2003 ___domain controller.<ref name=":1" />
SMB supports opportunistic locking (see below) on files in order to improve performance. Opportunistic locking support has changed with each Windows Server release.
=== Opportunistic locking ===
In the SMB protocol, opportunistic locking is a mechanism designed to improve performance by controlling [[cache (computing)|caching]] of network files by the client.<ref>{{cite web|date=May 31, 2018|title=Opportunistic Locks|url=https://docs.microsoft.com/en-us/windows/win32/fileio/opportunistic-locks|access-date=August 19, 2021|publisher=Microsoft|archive-date=August 19, 2021|archive-url=https://web.archive.org/web/20210819174457/https://docs.microsoft.com/en-us/windows/win32/fileio/opportunistic-locks|url-status=live}}</ref> Unlike traditional [[Lock (computer science)|locks]], opportunistic lock (OpLocks) are not strictly [[file locking]] or used to provide mutual exclusion.
There are four types of opportunistic locks.
; Batch Locks: Batch OpLocks were created originally to support a particular behavior of DOS batch file execution operation in which the file is opened and closed many times in a short period, which is a performance problem. To solve this, a client may ask for an OpLock of type "batch". In this case, the client delays sending the close request and if a subsequent open request is given, the two requests cancel each other.<ref name="Sphere2014">{{cite web|year=2014|title=All About Opportunistic Locking|url=https://sphereit.uk/all-about-opportunistic-locks/|access-date=August 19, 2021|website=Sphere IT|archive-date=August 19, 2021|archive-url=https://web.archive.org/web/20210819154425/https://sphereit.uk/all-about-opportunistic-locks/|url-status=live}}</ref>
; Level-1 OpLocks / Exclusive Locks: When an application opens in "shared mode" a file hosted on an SMB server which is not opened by any other process (or other clients) the client receives an '''exclusive OpLock''' from the server. This means that the client may now assume that it is the only process with access to this particular file, and the client may now cache all changes to the file before committing it to the server. This is a performance improvement, since fewer round-trips are required in order to read and write to the file. If another client/process tries to open the same file, the server sends a message to the client (called a ''break'' or ''revocation'') which invalidates the exclusive lock previously given to the client. The client then flushes all changes to the file.
; Level-2 OpLocks: If an exclusive OpLock is held by a client and a locked file is opened by a third party, the client has to relinquish its exclusive OpLock to allow the other client's write/read access. A client may then receive a "Level 2 OpLock" from the server. A Level 2 OpLock allows the caching of read requests but excludes write caching.
Line 34:
Since the release of Windows 2000, the use of WINS for name resolution has been deprecated by Microsoft, with hierarchical [[Dynamic DNS]] now configured as the default name resolution protocol for all Windows operating systems. Resolution of (short) NetBIOS names by DNS requires that a DNS client expand short names, usually by appending a connection-specific DNS suffix to its DNS lookup queries. WINS can still be configured on clients as a secondary name resolution protocol for interoperability with legacy Windows environments and applications. Further, Microsoft DNS servers can forward name resolution requests to legacy WINS servers in order to support name resolution integration with legacy (pre-Windows 2000) environments that do not support DNS.
[[Network planning and design|Network designers]] have found that [[
== History ==
=== SMB 1.0 ===
Barry Feigenbaum originally designed SMB at [[IBM]] in early 1983 with the aim of turning [[DOS]] [[INT 21h]] local file access into a networked file system.<ref name='tridgemyths'>{{cite web|url=https://www.samba.org/samba/docs/myths_about_samba.html|title=Myths About Samba|author=Tridgell, Andrew|author-link=Andrew Tridgell|access-date=January 3, 2016|archive-url=https://web.archive.org/web/20171020045502/https://www.samba.org/samba/docs/myths_about_samba.html|archive-date=October 20, 2017|url-status=live}}</ref> [[Microsoft]] made considerable modifications to the most commonly used version and included SMB support in the [[LAN Manager]] operating system it had started developing for [[OS/2]] with [[3Com]] around 1990.<ref name="theregister/2018/06/08/smb1">{{cite news |last1=Speed |first1=Richard |title=Have to use SMB 1.0? Windows 10 April 2018 Update says NO |url=https://www.theregister.com/2018/06/08/windows_10_smb1/ |access-date=18 February 2023 |work=[[theregister.com]] |language=en |archive-date=18 February 2023 |archive-url=https://web.archive.org/web/20230218011417/https://www.theregister.com/2018/06/08/windows_10_smb1/ |url-status=live }}</ref><ref name="borncity/2017/06/15/retire-smbv1">{{cite news |author1=guenni |title=Microsoft plans to deactivate SMBv1 in Windows 10 V1709 |url=https://borncity.com/win/2017/06/15/microsoft-plans-to-retire-smbv1-in-fall-in-windows-10/ |access-date=18 February 2023 |work=Born's Tech and Windows World |date=15 June 2017 |archive-date=18 February 2023 |archive-url=https://web.archive.org/web/20230218011414/https://borncity.com/win/2017/06/15/microsoft-plans-to-retire-smbv1-in-fall-in-windows-10/ |url-status=live }}</ref><ref name="thurrott/265909">{{cite news |last1=Giret |first1=Laurent |title=Microsoft Gets Ready to Disable SMB1 Protocol on Windows 11 |url=https://www.thurrott.com/windows/265909/microsoft-gets-ready-to-disable-smb1-protocol-on-windows-11 |access-date=18 February 2023 |work=Thurrott.com |date=20 April 2022 |archive-date=31 May 2024 |archive-url=https://web.archive.org/web/20240531142913/https://www.thurrott.com/windows/265909/microsoft-gets-ready-to-disable-smb1-protocol-on-windows-11 |url-status=live }}</ref> Microsoft continued to add features to the protocol in [[Windows for Workgroups]] ({{circa|1992}}) and in later versions of Windows. LAN Manager authentication was implemented based on the original legacy SMB specification's requirement to use IBM "LAN Manager" passwords, but implemented [[Data Encryption Standard|DES]] in a [[LM hash#Security weaknesses|flawed manner]] that allowed passwords to be cracked.<ref>{{cite web|author=Christopher Hertel|year=1999|title=SMB: The Server Message Block Protocol|url=http://ubiqx.org/cifs/SMB.html|url-status=live|archive-url=https://web.archive.org/web/20100310140946/http://ubiqx.org/cifs/SMB.html|archive-date=March 10, 2010|access-date=November 1, 2009}}</ref> Later, [[Kerberos (protocol)|Kerberos]] authentication was also added. The [[Windows ___domain]] logon protocols initially used [[40-bit encryption]] outside of the [[United States]], because of export restrictions on stronger 128-bit encryption<ref>{{cite web|date=November 1, 2006|title=Description of Microsoft Windows Encryption Pack 1|url=http://support.microsoft.com/kb/159709|url-status=live|archive-url=https://web.archive.org/web/20091002075623/http://support.microsoft.com/kb/159709|archive-date=October 2, 2009|access-date=November 1, 2009|publisher=[[Microsoft]]}}</ref> (subsequently lifted in 1996 when President [[Bill Clinton]] signed
SMB 1.0 (or SMB1) was originally designed to run on [[NetBIOS Frames]] (NetBIOS over [[IEEE 802.2]]). Since then, it has been adapted to NetBIOS over [[IPX/SPX]] (NBX), and [[NetBIOS over TCP/IP]] (NetBT). Also, since [[Windows 2000]], SMB runs on [[Transmission Control Protocol|TCP]] using TCP port 445, a feature known as "direct host SMB".<ref name="direct">{{cite web|url=http://support.microsoft.com/kb/204279|title=Direct hosting of SMB over TCP/IP|date=October 11, 2007|publisher=[[Microsoft]]|access-date=November 1, 2009|archive-url=https://web.archive.org/web/20110326164716/http://support.microsoft.com/kb/204279|archive-date=March 26, 2011|url-status=live}}</ref> There is still a thin layer (similar to the Session Message packet of NetBT's Session Service) between SMB and TCP.<ref name="direct" /> Windows Server 2003, and legacy [[Network-attached storage|NAS]] devices use SMB1 natively.
Line 45:
SMB1 is an extremely chatty protocol, which is not such an issue on a [[local area network]] (LAN) with low latency. It becomes very slow on [[Wide area network|wide area networks]] (WAN) as the back and forth handshake of the protocol magnifies the inherent high latency of such a network. Later versions of the protocol reduced the high number of handshake exchanges. One approach to mitigating the inefficiencies in the protocol is to use [[WAN optimization]] products such as those provided by [[Riverbed Technology|Riverbed]], [[Silver Peak Systems|Silver Peak]], or [[Cisco Systems|Cisco]]. A better approach is to upgrade to a later version of SMB. This includes upgrading both NAS devices as well as Windows Server 2003. The most effective method to identify SMB1 traffic is with a network analyzer tool, such as [[Wireshark]]. Microsoft also provides an auditing tool in [[Windows Server 2016]] to track down devices that use SMB1.<ref name="messageanalyzer">{{cite web |last1=Kyttle |first1=Ralph |title=SMB1 – Audit Active Usage using Message Analyzer |url=https://blogs.technet.microsoft.com/ralphkyttle/2017/05/13/smb1-audit-active-usage-using-message-analyzer/ |website=Microsoft TechNet |publisher=Microsoft |access-date=28 March 2019 |date=13 May 2017 |archive-url=https://web.archive.org/web/20190328223802/https://blogs.technet.microsoft.com/ralphkyttle/2017/05/13/smb1-audit-active-usage-using-message-analyzer/ |archive-date=March 28, 2019 |url-status=live }}</ref>
Microsoft has marked SMB1 as [[deprecation|deprecated]] in June 2013.<ref>{{Cite web|title=The Deprecation of SMB1 – You should be planning to get rid of this old SMB dialect – Jose Barreto's Blog|url=https://blogs.technet.microsoft.com/josebda/2015/04/21/the-deprecation-of-smb1-you-should-be-planning-to-get-rid-of-this-old-smb-dialect/|url-status=live|archive-url=https://web.archive.org/web/20170521154946/https://blogs.technet.microsoft.com/josebda/2015/04/21/the-deprecation-of-smb1-you-should-be-planning-to-get-rid-of-this-old-smb-dialect/|archive-date=May 21, 2017|access-date=2019-10-09|website=blogs.technet.microsoft.com|date=21 April 2015 }}</ref> Windows Server 2016 and [[Windows 10 version 1709]] do not have SMB1 installed by default.<ref>{{Cite web|title=SMBv1 is not installed by default in Windows 10 Fall Creators Update and Windows Server, version 1709 and later versions|url=https://support.microsoft.com/en-us/help/4034314/smbv1-is-not-installed-by-default-in-windows|url-status=live|archive-url=https://web.archive.org/web/20191010052046/https://support.microsoft.com/en-us/help/4034314/smbv1-is-not-installed-by-default-in-windows|archive-date=October 10, 2019|access-date=2019-10-09|website=support.microsoft.com}}</ref>
=== CIFS ===
In 1996, when Sun Microsystems announced [[WebNFS]],<ref name="WebNFS">{{cite web |title=WebNFS - Technical Overview |url=http://www.sun.com/software/webnfs/overview.xml |archive-url=https://web.archive.org/web/20070518204025/http://www.sun.com/software/webnfs/overview.xml |archive-date=2007-05-18}}</ref> Microsoft launched an initiative to rename SMB to Common Internet File System (CIFS)<ref name="tridgemyths" /> and added more features, including support for [[symbolic link]]s, [[hard link]]s, larger file sizes, and an initial attempt at supporting direct connections over TCP port 445 without requiring [[NetBIOS]] as a transport (a largely experimental effort that required further refinement). Microsoft submitted some partial specifications as [[Internet Draft]]s to the [[Internet Engineering Task Force|IETF]].<ref name="IETF">See:
* {{cite web|first1=I.
* {{cite web|first1=Paul J.
* {{cite web|first1=Paul J.
* {{cite web|first1=Paul J.
* {{cite web|first1=Paul J.
* {{cite web|first1=Paul J.
=== SMB 2.0 ===
Microsoft introduced a new version of the protocol (SMB 2.0 or SMB2) in 2006 with [[Windows Vista]] and [[Windows Server 2008]].<ref name="smb2">{{cite web | url=http://blogs.msdn.com/chkdsk/archive/2006/03/10/548787.aspx | title=What's new in SMB in Windows Vista | date=March 10, 2006 | access-date=May 1, 2006 | author=Navjot Virk and Prashanth Prahalad | work=Chk Your Dsks | publisher=[[Microsoft]] | url-status=dead | archive-url=https://web.archive.org/web/20060505005515/http://blogs.msdn.com/chkdsk/archive/2006/03/10/548787.aspx | archive-date=May 5, 2006 | df=mdy-all }}</ref> Although the protocol is proprietary, its specification has been published to allow other systems to interoperate with Microsoft operating systems that use the new protocol.<ref>{{cite tech report |url=https://docs.microsoft.com/openspecs/windows_protocols/ms-smb2 |title=Server Message Block (SMB) Protocol Versions 2 and 3 |department=Windows Protocols |work=Open Specifications |series=[[Microsoft Docs]] |institution=[[Microsoft]] |number=MS-SMB2 |access-date=2020-11-29}}</ref>
SMB2 reduces the 'chattiness' of the SMB 1.0 protocol by reducing the number of commands and subcommands from over a hundred to just nineteen.<ref name="barreto"/> It has mechanisms for [[Pipeline (computing)|pipelining]], that is, sending additional requests before the response to a previous request arrives, thereby improving performance over high-[[
SMB2 includes support for [[symbolic link]]s. Other improvements include caching of file properties, improved message signing with [[HMAC]] [[SHA-256]] hashing algorithm and better scalability by increasing the number of users, shares and open files per server among others.<ref name="barreto"/> The SMB1 protocol uses 16-bit data sizes, which amongst other things, limits the maximum block size to 64K. SMB2 uses 32- or 64-bit wide storage fields, and 128 bits in the case of [[file handle|file-handle]]s, thereby removing previous constraints on block sizes, which improves performance with large file transfers over fast networks.<ref name="barreto"/>
Line 67:
When SMB2 was introduced it brought a number of benefits over SMB1 for third party implementers of SMB protocols. SMB1, originally designed by [[IBM]], was [[reverse engineering|reverse engineered]], and later became part of a wide variety of non-Windows operating systems such as [[Xenix]], [[OS/2]] and [[OpenVMS|VMS]] ([[Pathworks]]). [[X/Open]] standardized it partially; Microsoft had submitted Internet-Drafts describing SMB2 to the [[Internet Engineering Task Force|IETF]], partly in response to formal IETF standardization of version 4 of the [[Network File System]] in December 2000 as IETF RFC 3010;<ref>{{cite IETF|rfc=3010|title=NFS version 4 Protocol|date=December 2000}}</ref> however, those SMB-related Internet-Drafts expired without achieving any IETF standards-track approval or any other IETF endorsement. (See http://ubiqx.org/cifs/Intro.html for historical detail.) SMB2 is also a relatively clean break with the past. Microsoft's SMB1 code has to work with a large variety of SMB clients and servers. SMB1 features many versions of information for commands (selecting what structure to return for a particular request) because features such as [[Unicode]] support were retro-fitted at a later date. SMB2 involves significantly reduced compatibility-testing for implementers of the protocol. SMB2 code has considerably less complexity since far less variability exists (for example, non-Unicode code paths become redundant as SMB2 requires Unicode support).
Apple migrated to SMB2 (from their own [[Apple Filing Protocol]], now legacy) starting with [[OS X Mavericks|OS X 10.9 "Mavericks"]].<ref name="ai2013">{{cite web |last=Eran |first=Daniel |url=http://appleinsider.com/articles/13/06/11/apple-shifts-from-afp-file-sharing-to-smb2-in-os-x-109-mavericks |title=Apple shifts from AFP file sharing to SMB2 in OS X 10.9 Mavericks |publisher=Appleinsider.com |date=June 11, 2013 |access-date=January 12, 2014 |archive-url=https://web.archive.org/web/20170212162139/http://appleinsider.com/articles/13/06/11/apple-shifts-from-afp-file-sharing-to-smb2-in-os-x-109-mavericks |archive-date=February 12, 2017 |url-status=live }}</ref> This transition was fraught with compatibility problems though.<ref>{{cite web |last=Vaughan |first=Steven J. |url=
The [[Linux kernel]]'s CIFS client file system has SMB2 support since version 3.7.<ref>{{cite web|url=https://kernelnewbies.org/Linux_3.7#head-7c9c911e4c41bcbc635cd8fa561278c833844bc2|title=Linux 3.7 - Linux Kernel Newbies|access-date=September 4, 2016|archive-url=https://web.archive.org/web/20160911130335/https://kernelnewbies.org/Linux_3.7#head-7c9c911e4c41bcbc635cd8fa561278c833844bc2|archive-date=September 11, 2016|url-status=live}}</ref>
Line 75:
=== SMB 3.0 ===
SMB 3.0 (previously named SMB 2.2)<ref name="smb3">{{cite web|url=https://cloudblogs.microsoft.com/windowsserver/2012/04/19/smb-2-2-is-now-smb-3-0/|work=Windows Server Blog|title=SMB 2.2 is now SMB 3.0|author=Jeffrey Snover|date=April 19, 2012|access-date=July 6, 2020|archive-date=July 8, 2020|archive-url=https://web.archive.org/web/20200708211728/https://cloudblogs.microsoft.com/windowsserver/2012/04/19/smb-2-2-is-now-smb-3-0/|url-status=live}}</ref> was introduced with [[Windows 8]]<ref name="smb3"/> and [[Windows Server 2012]].<ref name="smb3"/> It brought several significant changes that are intended to add functionality and improve SMB2 performance,<ref>{{cite web | url=http://www.chelsio.com/chelsio-to-demonstrate-40g-smb-direct-rdma-over-ethernet-for-windows-server-2012/ | title=40G SMB Direct | author=Chelsio Communications | date=2 April 2013 | access-date=June 18, 2013 | archive-url=https://web.archive.org/web/20130907065805/http://www.chelsio.com/chelsio-to-demonstrate-40g-smb-direct-rdma-over-ethernet-for-windows-server-2012/ | archive-date=September 7, 2013 | url-status=live }}</ref> notably in virtualized [[data center]]s:
* the SMB Direct Protocol (SMB over [[remote direct memory access]] [RDMA])
* SMB Multichannel (multiple connections per SMB session),<ref>{{cite web | url=https://www.eiseverywhere.com/file_uploads/b4f7436c4bc86fe545abe9fc042d4a7f_JoseBarreto_SMB3_Remote_File_Protocol_revision.pdf | title=SNIA Tutorial on the SMB Protocol | author=Jose Barreto | date=October 19, 2012 | access-date=November 28, 2012 | publisher=[[Storage Networking Industry Association]] | archive-url=https://web.archive.org/web/20130603133014/https://www.eiseverywhere.com/file_uploads/b4f7436c4bc86fe545abe9fc042d4a7f_JoseBarreto_SMB3_Remote_File_Protocol_revision.pdf | archive-date=June 3, 2013 | url-status=live }}</ref><ref>{{ cite web | url=http://www.snia.org/sites/default/files2/SDC2011/presentations/keynote/ThomasPfenning_The_Future_of_File_Protocols-final.pdf | title=The Future of File Protocols: SMB 2.2 in the Datacenter |archive-url=https://web.archive.org/web/20120720020805/http://www.snia.org/sites/default/files2/SDC2011/presentations/keynote/ThomasPfenning_The_Future_of_File_Protocols-final.pdf |archive-date=2012-07-20 | author=Thomas Pfenning }}</ref>
Line 86:
=== SMB 3.1.1 ===
SMB 3.1.1 was introduced with [[Windows 10]] and [[Windows Server 2016]].<ref>{{cite web|url=https://blogs.technet.microsoft.com/josebda/2015/05/05/whats-new-in-smb-3-1-1-in-the-windows-server-2016-technical-preview-2/|title=What's new in SMB 3.1.1 in the Windows Server 2016 Technical Preview 2|author=Jose Barreto|date=May 5, 2015|publisher=[[Microsoft TechNet]] Server & Management Blogs|access-date=August 14, 2016|archive-url=https://web.archive.org/web/20161008054848/https://blogs.technet.microsoft.com/josebda/2015/05/05/whats-new-in-smb-3-1-1-in-the-windows-server-2016-technical-preview-2/|archive-date=October 8, 2016|url-status=live}}</ref> This version supports [[Advanced Encryption Standard|AES-128]] [[Galois/Counter Mode|GCM]] encryption in addition to AES-128 [[CCM mode|CCM]] encryption added in SMB3, and implements pre-authentication integrity check using [[SHA-512]] hash. SMB 3.1.1 also makes secure negotiation mandatory when connecting to clients using SMB versions that support it.<ref>{{Cite web|url=https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-security#smb-encryption|title=SMB security enhancements|publisher=Microsoft Learn|access-date=2023-04-10|archive-date=2023-04-10|archive-url=https://web.archive.org/web/20230410045614/https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-security#smb-encryption|url-status=live}}</ref>
== Specifications ==
Line 105:
=== Netsmb ===
NSMB (Netsmb and SMBFS) is a family of in-kernel SMB client implementations in BSD operating systems. It was first contributed to [[FreeBSD]] 4.4 by Boris Popov, and is now found in a wide range of other BSD systems including [[NetBSD]] and [[macOS]].<ref>{{cite web |title=netsmb(4) |url=https://man.netbsd.org/NetBSD-8.0/man4/netsmb.4 |website=NetBSD 8.0 manual pages |access-date=5 January 2020 |archive-date=17 November 2022 |archive-url=https://web.archive.org/web/20221117092107/https://man.netbsd.org/NetBSD-8.0/man4/netsmb.4 |url-status=live }}</ref> The implementations have diverged significantly ever since.<ref>{{man|5|nsmb.conf|FreeBSD}}.</ref>
The macOS version of NSMB is notable for its now-common scheme of representing symlinks. This "Minshall-French" format shows symlinks as textual files with a {{code|.symlink}} extension and a {{code|Xsym\n}} magic number, always 1067 bytes long. This format is also used for storing symlinks on native SMB servers or unsupported filesystems. Samba supports this format with an {{code|mfsymlink}} option.<ref>{{cite web |title=UNIX Extensions |url=https://wiki.samba.org/index.php/UNIX_Extensions#Storing_symlinks_on_Windows_servers |website=SambaWiki |access-date=March 15, 2020 |archive-url=https://web.archive.org/web/20200612000308/https://wiki.samba.org/index.php/UNIX_Extensions#Storing_symlinks_on_Windows_servers |archive-date=June 12, 2020 |url-status=live }}</ref> Docker on Windows also seems to use it.{{Citation needed|date=May 2020}}
Line 113:
=== MoSMB ===
MoSMB is a
=== Fusion File Share by Tuxera ===
Line 120:
=== Likewise ===
Likewise developed a CIFS/SMB implementation (versions 1.0, 2.0, 2.1 and
===
[[
== Security ==
Over the years, there have been many security vulnerabilities in Microsoft's implementation of the protocol or components on which it directly relies.<ref>{{cite web|url=http://support.microsoft.com/kb/329170|title=MS02-070: Flaw in SMB Signing May Permit Group Policy to Be Modified|publisher=[[Microsoft]]|access-date=November 1, 2009|date=December 1, 2007|archive-url=https://web.archive.org/web/20091008113615/http://support.microsoft.com/kb/329170|archive-date=October 8, 2009|url-status=live}}</ref><ref>{{cite web|url=http://support.microsoft.com/kb/958687|title=MS09-001: Vulnerabilities in SMB could allow remote code execution|publisher=[[Microsoft]]|access-date=November 1, 2009|date=January 13, 2009|archive-url=https://web.archive.org/web/20091005062727/http://support.microsoft.com/kb/958687|archive-date=October 5, 2009|url-status=live}},</ref> Other vendors' security vulnerabilities lie primarily in a lack of support for newer [[authentication protocol]]s like [[NTLMv2]] and [[Kerberos (protocol)|Kerberos]] in favor of protocols like NTLMv1, [[LM hash|LanMan]], or [[plaintext]] passwords. Real-time attack tracking<ref>{{cite web|url=http://www.sicherheitstacho.eu|title=Sicherheitstacho.eu|publisher=[[Deutsche Telekom]]|access-date=March 7, 2013|date=March 7, 2013|archive-url=https://web.archive.org/web/20130308043532/http://www.sicherheitstacho.eu/|archive-date=March 8, 2013|url-status=live}}</ref> shows that SMB is one of the primary attack vectors for intrusion attempts,<ref>{{cite web|url=https://www.us-cert.gov/ncas/alerts/TA14-353A|title=Alert (TA14-353A) Targeted Destructive Malware|publisher=[[US-CERT]]|access-date=December 20, 2014|archive-url=https://web.archive.org/web/20141220134115/https://www.us-cert.gov/ncas/alerts/TA14-353A|archive-date=December 20, 2014|url-status=live}}</ref> for example the [[Sony Pictures hack|2014 Sony Pictures attack]],<ref>{{cite web|url=http://www.securityweek.com/hackers-used-sophisticated-smb-worm-tool-attack-sony|title=Sony Hackers Used Server Message Block (SMB) Worm Tool|date=19 December 2014 |access-date=December 20, 2014|archive-url=https://web.archive.org/web/20141220134150/http://www.securityweek.com/hackers-used-sophisticated-smb-worm-tool-attack-sony|archive-date=December 20, 2014|url-status=live}}</ref> and the [[WannaCry ransomware attack]] of 2017.<ref>{{cite news|url=http://www.eweek.com/security/wannacry-ransomware-attack-hits-victims-with-microsoft-smb-exploit|title=WannaCry Ransomware Attack Hits Victims With Microsoft SMB Exploit|work=[[eWeek]]|access-date=13 May 2017}}</ref> In 2020, two SMB high-severity vulnerabilities were disclosed and dubbed as [[SMBGhost (security vulnerability)|SMBGhost]] ([https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796 CVE-2020-0796]) and [https://www.hackreports.com/smbleed-smbghost-latest-windows-smb-protocol-vulnerability-smbleedingghost/ SMBleed] ([https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1206 CVE-2020-1206]), which when chained together can provide [[Remote code execution|RCE (Remote Code Execution)]] privilege to the attacker.<ref>{{Cite web|date=2020-06-09|title=SMBleedingGhost Writeup: Chaining SMBleed (CVE-2020-1206) with SMBGhost|url=https://blog.zecops.com/vulnerabilities/smbleedingghost-writeup-chaining-smbleed-cve-2020-1206-with-smbghost/|access-date=2020-11-19|website=ZecOps Blog|language=en|archive-date=2020-11-27|archive-url=https://web.archive.org/web/20201127202823/https://blog.zecops.com/vulnerabilities/smbleedingghost-writeup-chaining-smbleed-cve-2020-1206-with-smbghost/|url-status=live}}</ref>
== See also ==
Line 158:
=== Miscellaneous ===
{{Refbegin}}
* Hertel, Christopher (2003). ''[http://www.ubiqx.org/cifs/Book.html Implementing CIFS{{snd}} The Common Internet FileSystem] {{Webarchive|url=https://web.archive.org/web/20040202181950/http://ubiqx.org/cifs/Book.html |date=2004-02-02 }}''. Prentice Hall. {{ISBN|0-13-047116-X}}. (Text licensed under the [[Open Publication License]], v1.0 or later, available from the link above.)
* Steven M. French, [https://www.kernel.org/doc/ols/2007/ols2007v1-pages-131-140.pdf A New Network File System is Born: Comparison of SMB2, CIFS, and NFS] {{Webarchive|url=https://web.archive.org/web/20120907100828/http://www.kernel.org/doc/ols/2007/ols2007v1-pages-131-140.pdf |date=2012-09-07 }}, [[Linux Symposium]] 2007
* Steve French, [http://www.samba.org/~sfrench/presentations/smf-linux-collab-summmit-future-of-file-protocols-smb2.2.pdf The Future of File Protocols: SMB2 Meets Linux] {{Webarchive|url=https://web.archive.org/web/20180817112740/https://www.samba.org/~sfrench/presentations/smf-linux-collab-summmit-future-of-file-protocols-smb2.2.pdf |date=2018-08-17 }}, Linux Collaboration Summit 2012
{{Refend}}
| |||