Edumacate me on SMB

[red-beard]

One of NAVs died last year, so I brought out an old one. This is used at the house, but mostly for backup from the office.

Apparently, the old NAV uses SMBv1

Windows 10 does not automatically support SMBv1 anymore, since it is supposed to be insecure.

The NAS can do NFS and iSCSI, but I cannot seem to get Windows 10 to play with those...

The NAS is EOL, so no more firmware updates...

How risky is activating SMBv1 on Windows 10, if the only thing I connect is an internal NAS?

[id10t]

Properly hidden behind a firewall no issues.

Or get a old desktop, a few drives, install Linux, set up software RAID-1 or -5, and use current versions of Samba/CIFS ... Also the possibility of installing OwnCloud and similar.

[stomachmonkey]

It’s a 30 year old protocol.

It’s not what you connect via SMB, it’s what someone else can connect.

SMB1 is highly vulnerable to man in the middle exploits.

The question really is, what’s the sensitivity of the data you may be exposing?

[red-beard]

Originally Posted by stomachmonkey

It’s a 30 year old protocol.

It’s not what you connect via SMB, it’s what someone else can connect.

SMB1 is highly vulnerable to man in the middle exploits.

The question really is, what’s the sensitivity of the data you may be exposing?

It is short term solution. It is only on the internal network, no remote, etc. It will be replaced this year.

My real concern was activating SMBv1 on the Windows 10 machine.

[stomachmonkey]

Originally Posted by red-beard

It is short term solution. It is only on the internal network, no remote, etc. It will be replaced this year.

My real concern was activating SMBv1 on the Windows 10 machine.

Running it is not a compatibility issue, it won’t cause problems.

It’s depricated purely on security.

[red-beard]

Originally Posted by stomachmonkey

Running it is not a compatibility issue, it won’t cause problems.

It’s depricated purely on security.

I'm more concerned with my laptop which does get in the wild sometimes. It sounds like only a problem if I used SMBv1 outside.

[stomachmonkey]

Originally Posted by red-beard

I'm more concerned with my laptop which does get in the wild sometimes. It sounds like only a problem if I used SMBv1 outside.

Create a 2nd firewall config that toggles ports 445 and 139 when laptop is in the wild.

[red-beard]

Or I can switch SMBv1 off when I'm outside

[stomachmonkey]

Originally Posted by red-beard

Or I can switch SMBv1 off when I'm outside

I think enabling / disabling that way requires a reboot.

Easier in my mind to leave enabled and just block it.