{{tag>FS Windows Réseau}} # Client Samba SMB CIFS Voir aussi * [[Serveur Samba SMB CIFS]] * CIFS Unix Extensions / Services for Unix (SFU) Voir : * rclone * curl smb / smbs ## Install ~~~bash apt-get install cifs-utils smbclient ~~~ ## Exemple `auth.cfg` ~~~ini username=jean password=P@ssw0rd domain=D$ ~~~ ~~~bash smbclient -A auth.cfg //192.168.1.12/D$/ -c ls ~~~ ### Lister les partages Anonymement ~~~bash smbclient -N -L 127.0.0.1 ~~~ Avec un compte ~~~bash smbclient -U utilisateur%mdp -L 127.0.0.1 ~~~ Ou (debug) ~~~bash smbtree -N -d3 ~~~ ### Se connecter #### smbclient ~~~bash smbclient -U utilisateur%mdp '\\127.0.0.1\partage' ~~~ #### gvfs-mount ~~~bash gvfs-mount smb://server/share ~~~ #### libpam-mount ~~~bash apt-get install libpam-mount ~~~ `/etc/security/pam_mount.conf.xml` ~~~xml ~~~ ## Sécurité / Hardening / pentest Voir nmap, smbmap, rpcclient, nbtscan, enum4linux * https://www.infosecademy.com/nmap-smb-scripts-enumeration/ Pour tester ~~~bash nmap -A 127.0.0.1 nmap --script smb-os-discovery.nse -p445 127.0.0.1 sudo nmap -sU -sS --script smb-os-discovery.nse -p U:137,T:139 127.0.0.1 nmap --script smb-enum-shares.nse -p445 sudo nmap -sU -sS --script smb-enum-shares.nse -p U:137,T:139 127.0.0.1 nmap --script smb-enum-users.nse -p445 sudo nmap -sU -sS --script smb-enum-users.nse -p U:137,T:139 127.0.0.1 ~~~ Disable less secure legacy dialects `/etc/modprobe.d/cifs.conf` ~~~bash options cifs disable_legacy_dialects=1 ~~~ ~~~bash echo 1 > /sys/module/cifs/parameters/disable_legacy_dialects # Y or 1 stands for enabled # N or 0 stands for disabled ~~~ ## Autres clients Display CIFS statics with Mega bytes per a 1 second 3 times (sysstat) ~~~bash cifsiostat -m 1 3 ~~~ ### Userland Equiv : ~~~ mount.cifs -o credentials=/home/share/.auth.cfg,uid=1000,forceuid,gid=1000,forcegid,file_mode=0777,dir_mode=0777,noperm,port=1446,vers=2.0 //127.0.0.1/share /mnt/share/ ~~~ ~~~bash #sudo apt-get install fusesmb sudo apt-get install smbnetfs mkdir .smb cp /etc/smbnetfs.conf ~/.smb/ chmod 600 ~/.smb/smbnetfs.conf cp /etc/samba/smb.conf ~/.smb/ mkdir -p Network smbnetfs Network cd Network/127.0.0.1:1446/ cd Network/share:'domain\user1':'P@ssw0rd'@127.0.0.1:1446/Install ~~~ `~/.smb/smbnetfs.conf` ~~~ log_file "/tmp/smbnetfs.log" show_$_shares "true" show_hidden_hosts "true" auth "guest" "" include "smbnetfs.auth" ~~~ `~/.smb/smbnetfs.auth` ~~~ auth "smb-sh" "DOMAIN/user1" "P@ssw0rd" auth "127.0.0.1" "DOMAIN/user1" "P@ssw0rd" auth "127.0.0.1:1446" "DOMAIN/user1" "P@ssw0rd" ~~~ ~~~bash chmod 600 ~/.smb/smbnetfs.auth ~~~ ## Cache avec cachefilesd / FS-Cache Voir : * https://lars.timmann.de/wiki/index.php?title=Cachefilesd * https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/managing_file_systems/getting-started-with-fs-cache_managing-file-systems * https://www.kernel.org/doc/html/latest/filesystems/caching/cachefiles.html * https://serverfault.com/questions/602203/cachefilesd-cachefiles-everything-seems-to-be-set-up-still-not-working ## Autres ~~~bash findmnt -n -s -t cifs ~~~ ~~~bash mkdir /mnt/nompartage ~~~ `/etc/fstab` ~~~ //ouindoze/nompartage /mnt/nompartage cifs credentials=/home/jean/.smbcredentials,rw,auto,user,nounix,noserverino,iocharset=utf8,file_mode=0777,dir_mode=0777 0 0 //public/plop /mnt/espace_build_ovs/ cifs _netdev,rw,uid=15041,forceuid,gid=15141,forcegid,file_mode=0777,dir_mode=0777,noperm,credentials=/etc/.cifs_public_plop 0 0 ~~~ ~~~bash mount -t cifs //mystorage/data2 -o username=user1,password=myPassword,rw,bg,vers=3,proto=tcp,hard,intr,rsize=32768,wsize=32768,forcedirectio,llock /data2 ~~~ `/etc/modprobe.d/cifs.conf` ~~~bash # Disable caching and the CIFS oplog for stable NTFS network shares options cifs enable_oplocks=0 install cifs /sbin/modprobe --ignore-install cifs $CMDLINE_OPTS && echo 0 > /proc/fs/cifs/LinuxExtensionsEnabled && echo 0 > /proc/fs/cifs/LookupCacheEnabled remove cifs /sbin/modprobe -r cifs ~~~ Fichiers contenant les identifiants en clair (pour ne pas les mettre dans le fstab) `/etc/.cifs_public_plop` ~~~ini #domain=domain username=utilisateur password=motdepasse ~~~ `/home/jean/.smbcredentials` ~~~ini username=utilisateur password=motdepasse ~~~ Vous pouvez éventuellement ajouter : \ `domain=MONDOMAINE` Ou encore le mettre après le "username" comme : \ `username=utilisateur@MONDOMAINE` ou bien \ `username=MONDOMAINE\utilisateur` ~~~bash chmod 600 /home/jean/.smbcredentials /etc/.cifs_public_plop ~~~ Puis ~~~bash mount /mnt/nompartage ~~~ ## Pb ### Démonter / libérer les partitions CIFS en erreur (ou non) ~~~ # mount | grep /mnt/shared systemd-1 on /mnt/shared type autofs (rw,relatime,fd=28,pgrp=1,timeout=10,minproto=5,maxproto=5,direct,pipe_ino=38828) ~~~ ~~~bash sudo umount -a -t cifs -l sudo umount -a -t autofs -l ~~~ ### Err NT_STATUS_LOGON_FAILURE (with authfile only) Voir https://bugzilla.redhat.com/show_bug.cgi?id=78846 ~~~ # smbclient -A /etc/.creds //server-smb/partage1/ session setup failed: NT_STATUS_LOGON_FAILURE ~~~ ~~~ # rpcclient vmx-gspl -d 1 -A /etc/.creds -c "getdriverdir \"Windows NT x86\"" Cannot connect to server. Error was NT_STATUS_LOGON_FAILURE ~~~ ~~~ # smbclient -U jean -W DOMAIN //server-smb/partage1/ Enter jean's password: Domain=[ACME] OS=[Unix] Server=[Samba 3.6.6] smb: \> ~~~ ### Err NT_STATUS_CONNECTION_DISCONNECTED ~~~ $ smbclient -U user%'P@ssw0rd' -p 1445 //127.0.0.1/E WARNING: The "syslog" option is deprecated protocol negotiation failed: NT_STATUS_CONNECTION_DISCONNECTED ~~~ #### Solution Ajouter `-m SMB3` ou ajouter `--option='client min protocol=NT1` ~~~bash smbclient -U user%'P@ssw0rd' -p 1445 //127.0.0.1/E -m SMB3 smbclient -U user%'P@ssw0rd' -p 1445 //127.0.0.1/E --option='client min protocol=NT1' ~~~ ### Pb temps de connexion long - NTLMSSP ~~~ plop@portable:~$ smbclient -U user%'P@ssw0rd' -p 1445 //127.0.0.1/D -m SMB3 -d 3 lp_load_ex: refreshing parameters Initialising global parameters rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384) Processing section "[global]" WARNING: The "syslog" option is deprecated added interface wlan0 ip=2a01:cb04:bae:2600:9aea:4ae:b4b3:15a2 bcast= netmask=ffff:ffff:ffff:ffff:: added interface docker0 ip=172.17.42.1 bcast=172.17.255.255 netmask=255.255.0.0 added interface wlan0 ip=192.168.1.12 bcast=192.168.1.255 netmask=255.255.255.0 Client started (version 4.5.16-Debian). Connecting to 127.0.0.1 at port 1445 Doing spnego session setup (blob length=398) got OID=1.3.6.1.4.1.311.2.2.30 got OID=1.2.840.48018.1.2.2 got OID=1.2.840.113554.1.2.2 got OID=1.2.840.113554.1.2.2.3 got OID=1.3.6.1.4.1.311.2.2.10 got principal=not_defined_in_RFC4178@please_ignore GENSEC backend 'gssapi_spnego' registered GENSEC backend 'gssapi_krb5' registered GENSEC backend 'gssapi_krb5_sasl' registered GENSEC backend 'spnego' registered GENSEC backend 'schannel' registered GENSEC backend 'naclrpc_as_system' registered GENSEC backend 'sasl-EXTERNAL' registered GENSEC backend 'ntlmssp' registered GENSEC backend 'ntlmssp_resume_ccache' registered GENSEC backend 'http_basic' registered GENSEC backend 'http_ntlm' registered GENSEC backend 'krb5' registered GENSEC backend 'fake_gssapi_krb5' registered Got challenge flags: Got NTLMSSP neg_flags=0x62898215 NTLMSSP: Set final flags: Got NTLMSSP neg_flags=0x62088215 NTLMSSP Sign/Seal - Initialising with flags: Got NTLMSSP neg_flags=0x62088215 NTLMSSP Sign/Seal - Initialising with flags: Got NTLMSSP neg_flags=0x62088215 Domain=[PLOP] OS=[] Server=[] smb: \> ~~~ Où il y a trois lignes vides, ça a mis plusieurs secondes. \ Dans le cas présent le contrôleur de domaine n'est pas joignable et nous utilisons un compte local. #### Solution Spécifier le domaine "." \ Le point indique un compte local (hors du domaine) \ Vous pouvez utiliser l'option `-W` ~~~bash smbclient -U user%'P@ssw0rd' -p 1445 //127.0.0.1/D -m SMB3 -W . ~~~ #### Solution Mettre à jour smbclient et ses dépendances ~~~ # apt-get install smbclient The following extra packages will be installed: libldb1 libsmbclient samba-common samba-libs ~~~ ### Pb CIFS VFS: cifs_mount failed w/return code = -61 - NT_STATUS_PATH_NOT_COVERED Erreur ~~~ # dmesg [1231082.766925] CIFS VFS: cifs_mount failed w/return code = -61 ~~~ Diag ~~~ # smbclient -U jean -W ACME \\partages\images smb: \> cd REP\ Connection to pc1111 failed (Error NT_STATUS_BAD_NETWORK_NAME) Unable to follow dfs referral [\pc1111\REP$] cd \REP\: NT_STATUS_PATH_NOT_COVERED # ping pc1111 ping: unknown host pc1111 ~~~ ##### Solution Modifier le `/etc/hosts` ou `/etc/resolv.conf` afin de résoudre pc1111 ### Pb error(22): Invalid argument ~~~ # mount -t cifs -o rw,uid=1000,forceuid,gid=1000,forceuid,file_mode=0777,dir_mode=0777,noperm,credentials=/root/.fichier_mdp //server/partage /mnt/nompartage mount error(22): Invalid argument Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg) # dmesg -T | tail [Wed Dec 23 11:31:16 2020] CIFS: Attempting to mount //server/partage [Wed Dec 23 11:31:16 2020] CIFS: VFS: cifs_mount failed w/return code = -22 ~~~ #### Solution Spécifier la version souhaitée Exemple : `vers=2.0` ~~~bash mount -t cifs -o rw,uid=1000,forceuid,gid=1000,forcegid,file_mode=0777,dir_mode=0777,noperm,vers=2.0,credentials=/root/.fichier_mdp //server/partage /mnt/nompartage ~~~ ### Err NT_STATUS_LOGON_FAILURE ~~~ $ smbclient -U user1%'BasP@ssw0rd' '\\localhost\shared' session setup failed: NT_STATUS_LOGON_FAILURE $ smbclient -U user1%'P@ssw0rd' '\\localhost\shared' Domain=[localhost] OS=[Unix] Server=[Samba 3.0.33-3.7.el5] tree connect failed: NT_STATUS_BAD_NETWORK_NAME ~~~ #### Solution Le partage pointait vers un dossier non existant. ## Notes Exemple options de montage ~~~ on /data/users_homedirs type cifs (rw,relatime,sec=ntlm,unc=\\serveur\Home$,username=utilisateur,domain=ACME,uid=1000,forceuid,gid=1000,forcegid,addr=192.168.1.20,file_mode=0755,dir_mode=0755,nounix,rsize=61440,wsize=65536,actimeo=1) ~~~