PowerScale: OneFS: How to enable or disable SMB1 on a Cluster

Due to security concerns, Dell Technologies does not recommend enabling the SMBv1 protocol dialect in OneFS. To ensure long-term compatibility, consider transitioning away from this protocol.

Note: SMBv1 is no longer supported by Microsoft. Microsoft recommends that workflows that use SMBv1 dialect be migrated over to use SMBv2 or later. Newer supported versions of the SMB dialect are designed for better security and performance. See this link for additional information about why you should move away from SMBv1 dialect in workflows. It is not recommend using SMBv1 in situations where higher versions of the dialect are available for use.

To verify whether support for the SMB1 protocol is enabled or disabled, establish an SSH connection to a node and then run the following command:

isi_gconfig registry.Services.lwio.Parameters.Drivers.srv.SupportSmb1

If the reported value is a zero, then it is disabled. If the value reported is one, then it is enabled.
 

To disable support of SMBv1:

isi_gconfig registry.Services.lwio.Parameters.Drivers.srv.SupportSmb1=0

To enable support of SMBv1:

isi_gconfig registry.Services.lwio.Parameters.Drivers.srv.SupportSmb1=1

A refresh (or restart) of the SRV service on the cluster is required to implement changes for SMBv1 supportability.

Disabling support for the SMB1 protocol prevents new SMB1 connections from being established. Existing SMB1 connections are not disconnected even after disabling the feature.

Warning:
Restarting the SRV service on a node may cause all SMB connections to the node to be disconnected. If the SMB client connections do not fail over to another node, the clients must reestablish a connection to the cluster. If LWIO is restarted, then all SMB connections are terminated and client reestablishment of connections are required.

A forced refresh of SRV can be done on a single node by connecting over SSH and doing the following:

/usr/likewise/bin/lwsm refresh srv

In rare circumstances, a restart of the SRV service is required. Do the following:

/usr/likewise/bin/lwsm restart srv

Admins may use "isi_for_array -sX" before the commands to refresh or restart SRV across the cluster. Ensure that the nested command is contained in quotes. While the refresh of SRV is not impactful, restarting it might be. Plan for these actions in a maintenance window to mitigate disruption to clients. If administrators notice any issues with these actions, it is recommended that they engage Support for further assistance.

Starting in OneFS 9.6 the SMBv1 protocol is disabled by default. Microsoft has ended support for the protocol and there are numerous security concerns with it that have been addressed in newer dialects. A cluster using SMBv1 sees a disruption to their workflow postupgrade as a result. Admins can avoid this by manually enabling SMBv1 instead of relying strictly on the older default configuration. Setting SMBv1 to enabled marks the setting as "not inherited from defaults," ensuring no changes to that part of the configuration postupgrade.

To ensure that the value is manually enabled in OneFS 9.5 and earlier, follow the earlier steps to enable SMBv1 manually through the gconfig. Administrators should do this in a maintenance window to minimize disruption to SMBv1 clients. The command to enable SMBv1 with the gconfig in OneFS 9.5 and earlier is below:

isi_gconfig registry.Services.lwio.Parameters.Drivers.srv.SupportSmb1=1

Remember to validate that the value reports the value 1 back. Admins may disable then enable support for SMBv1 to confirm the value changes take effect. If there are plans to use SMBv1 prior to the upgrade after it is enabled, an SRV refresh or restart is required on all nodes. This is impactful to clients using SMB protocol regardless of which dialect is used.

If admins forget to explicitly enable SMBv1 on the cluster configuration prior to the upgrade, then the upgrade ensures it is set to disabled. Use the command below postupgrade to reenable support of SMBv1.

isi smb settings global modify --support-smb1=true

This may require a forced refresh/restart of services to have those changes take effect. We recommend any significant changes to the cluster configuration be done during a maintenance window to minimize impact. Administrators should begin planning the full deprecation of SMBv1 in their environment if they have not done so already.