How can I disable SMBv1?

Question

Hi all, How Can I disable SMBv1? Because I want to take measures for WannaCryptor. Best Regards.

Rainer_EMC · Accepted Answer

If you still want to disable SMB1 on the VNX - even though its not necessary - you can do that easily via a param change

For VNX and older products, from CS using the user nasadmin ssh session,

server_param ALL –f cifs –m smb1.disabled -v 1

For Unity 4.1.x, from the master SP using the user service user ssh session,

svc_param ALL –f cifs –m smb1.disabled -v 1

Just keep in mind that this will lock out all CIFS clients that only support SMB1 like Windows XP and older plus other devices like some network printers or scanners

Rainer_EMC · Answer

Hi,

disabling SMBv1 on Unity / VNX / VNXe is NOT necessary.

On unpatched Windows systems WannaCry can use a Microsoft bug to infect them through a remote execution vulnerability in the Microsoft SMB code.

This is not present on Unity / VNX / VNXe since it does NOT run the Microsoft SMB stack.

Plus it doesnt run Windows OS so WannaCrypt wouldnt run there even if it could get there.

Please be careful though and do not disable SMB1 on the domain controller that the systems are using for authentication - for talking to the DC with SMBv2 you would need a hotfix on the Unity / VNX / VNXe

mikko1 · Answer

Hi, Is there a need for a hotfix for unity? I thought that 4.1.1 was supposed to add SMBv2 communication support with domain controllers?

Nori_Ishitsuka · Answer

Rainer_EMC, Thank you for your kindness information. I can understand for technical background and disable procedure. It's very important and interesting information, thank you again. Best Regards.

Rainer_EMC · Answer

You could just as well disable SMB1 on the clients - Microsoft has instructions and PowerShell tools for that available Especially since each client quickly becomes a server once you share a directory

Rainer_EMC · Answer

you're welcome

please keep in mind that its absolutely not necessary to disable SMB1 on VNX/Unity/VNXe because of WannaCry

If it makes you feel more secure you can do so - just keep in mind that this can lock out old clients

DELL_ChrisHolloway · Answer

A new KB article has been published today covering SMB1 and how to disable it

https://emcservice--c.na55.visual.force.com/apex/KB_How_To?id=kA5f1000000CdqY

For VNXe, the KB says you should contact EMC Support for assistance.

Nori_Ishitsuka · Answer

Thank you for your kindness information.

And can I ask one more question?

I have some VNXe units, both VNXe1 and VNXe2.

How can I disable SMBv1 on that?

I've understood that is not necessary to disable on the Storage,but IT manager said that...

Regards.

Spencer Simpson · Answer

Broken link; this just gives me the EMC support home page.

Rainer_EMC · Answer

the link works fine for me - you first have to have authenticated with support.emc.com you can also get to it by entering the kb number (499999) or searching for SMB1 disable

mikko1 · Answer

Hi, Link does not work with customer permissions.(Even if login to the support site before opening.) Redirects to the support main page. Also kb 499999 is not available.

mikko1 · Answer

Hi, Yes. There seems to be something wrong with the support site. Now I only get an empty white page with FireFox when connecting to support.emc.com.

Rainer_EMC · Answer

seems to be a temporary problem - for me the link currently works with FireFox but not with IE

if you need it you can always contact customer service via live chat or phone or service request and have them send it to you

Spencer Simpson · Answer

Firefox, Chrome, IE, Edge, it doesn't work for us. This has gone out of the scope of the original question, but it needs to be clarified: As an EMC employee, you probably have accesses that the rest of us don't.  I recall when I first started using EMC's support portal, where I had to call EMC multiple times to unlock things I needed access to.  This seems like another one of those instances, but the juice is no longer worth the squeeze.

Rainer_EMC · Answer

The support site in general should work right now

I just opened it from a home PC with a guest account and it worked.

The specific kb mentioned is currently not available - but the others are.
Note that for knowledgebase access you seem to need a support account that is associated with a site ID

documention and downloads also work with a guest account

Unity

How can I disable SMBv1?

Was this post helpful?