Dell Storage Manager 2020 R1 Administrator's Guide

Enable or Disable SMB Message Signing

To help prevent attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. SMB2 protocol 3.1.1 dialect adds pre-authentication integrity, cipher negotiation, AES-128-GCM cipher, and cluster dialect fencing. Pre-authentication integrity improves protection from an attacker in tampering with SMB2’s connection establishment and authentication of messages. The cipher can be negotiated during connection establishment. In addition to AES-128-CCM cipher used at SMB 3.0.x, Windows 10 (and Windows Server 2016) added AES-128-GCM cipher in SMB 3.1.1. The GCM mode offers a significant performance gain.

1. In the Storage view, select a FluidFS cluster.
2. Click the File System tab.
3. In the File System view, select Client Accessibility.
4. Click the Protocols tab.
5. In the SMB Protocol panel, click Edit Settings.
   The Edit Settings dialog box opens.
6. Enable or disable required message signing:
   • To enable required message signing, select the SMB Signing Enforcement checkbox.
   • To disable required message signing, clear the SMB Signing Enforcement checkbox.
7. Click OK.