Author Topic: How to enable SMBv2 on Linkstation LS-WXL systems so it works with modern OSes  (Read 20473 times)

mishikal

  • Calf
  • *
  • Posts: 5
This requires enabling remote SSH access to the system, but once you do that and log in as root, modify /etc/init.d/smb.sh

There is a configure() function that calls /usr/local/sbin/nas_configgen -c samba, which always overwrites /etc/samba/smb.conf.  To allow SMBv2, modify the code as follows.

From:
Code: [Select]
        /usr/local/sbin/nas_configgen -c samba
        if [ $? -ne 0 ]; then
                echo "$0 configure fail"
                exit 1
        fi

To:
Code: [Select]
    /usr/local/sbin/nas_configgen -c samba
        if [ $? -ne 0 ]; then
                echo "$0 configure fail"
                exit 1
        fi
        /bin/sed -i '3i\\
    min protocol = SMB2\\
    max protocol = SMB2\\
        ' /etc/samba/smb.conf


Then run /etc/init.d/smb.sh reload and the NAS will now allow SMBv2 connections.  Enjoy!
« Last Edit: April 30, 2018, 04:53:18 pm by mishikal »

ArronHad

  • Calf
  • *
  • Posts: 1
Nice one Mishikal, it took me a couple of tries but got it working perfect in the end! Feels good to be all setup.

StephenDavis1977

  • Calf
  • *
  • Posts: 2
How do I do this on a Windows 10 machine that cannot access the LinkStation?

patator

  • Calf
  • *
  • Posts: 1
Quote
How do I do this on a Windows 10 machine that cannot access the LinkStation?

First you need to get root access on your linkstation using ACP Commander.
I used this http://nerdkey.co.uk/guides/enable-ssh-linkstation-stock-firmware/ as it sounded easy enough at that time.

For the next steps, I take it you are not familiar with Unix, so here is a step by step once you have root access.

Login as root using PUTTY
once done, type
cp  /etc/init.d/smb.sh /root
This will cpy the file in case you make a mistake.

vi  /etc/init.d/smb.sh
this editor is quite unfriendly, so follow the following key strokes ([ESC] is the key esape, not the letters):
[ESC]/nas_config
use the arrow to go at the end of this section:
Code: [Select]
/usr/local/sbin/nas_configgen -c samba
        if [ $? -ne 0 ]; then
                echo "$0 configure fail"
                exit 1
        fi
type A then enter
copy the following and right click to paste in putty:
Code: [Select]
/bin/sed -i '3i\\    max protocol = SMB2\\' /etc/samba/smb.confthen hit the following keys:
[ESC]:wq

to try that it worked:
/etc/init.d/smb.sh restart

You should now be able to access your files on Windows10.

Good luck!

« Last Edit: February 18, 2018, 11:33:20 am by patator »

jurrabi

  • Calf
  • *
  • Posts: 2
This might be a stupid question but, how come this is not enabled by default in the latest 1.74 firmware version for my Linkstation LS-WXL?? I mean, that update is dated Feb, 2018 and the Buffalo site states that the model is Windows 10 compatible witch can't be without SMBv2 enabled...
WTF?

Since I don't seem able to get root or SSH access to my device... what are my options?

Any ideas? thanks in advance.

oxygen8

  • Buffalo
  • ***
  • Posts: 243
  • Giving you some breathing space.
"Windows 10 compatible witch can't be without SMBv2 enabled.."

this is not correct
Microsoft have disabled SMB1

Now Windows is not compatibel to old nas

enable SMB1 on windows

mishikal

  • Calf
  • *
  • Posts: 5
enable SMB1 on windows

Under no circumstances should you enable SMB1.  Microsoft disabled it for a reason: SMBv1 has numerous security flaws at the protocol level.  That is why they disabled it in the first place.  The correct solution is to enable SMBv2 as documented above.

Why Buffalo isn't including this in their firmware updates is beyond me.  It's trivial to do.

See also https://www.us-cert.gov/ncas/current-activity/2017/03/16/Microsoft-SMBv1-Vulnerability

Basically, if you enable SMBv1, anyone on your network can take over your computer.

mishikal

  • Calf
  • *
  • Posts: 5
Note: I've updated the original suggestion so that SMBv1 is entirely disabled, given the security risks of allowing it.

mparker

  • Calf
  • *
  • Posts: 1
So first off thank you for all who contributed to this fix. It works, for the most part.
So, that being said I have an issue that I can't seem to figure out yet is this.

I have a Windows 10 machine that is my personal laptop
Windows 10 Pro version 10.0.17134 Build 17134
this is the machine I SSH'd to the Linkstation LS-QVL from and made the changes as you listed above.
I figured that would be the end of it and the issue was fixed. So I started notifying my users. They still cannot access the Linkstation which baffles me completely.

Their machines are the exact same build
Windows 10 Pro version 10.0.17134 Build 17134
I did a complete fresh install on a test machine and it cannot access the linkstation.
Only difference between their machines and the test machine is that it is a Work Machine that is connected to Azure AD where mine is a personal machine not connected to Azure AD. That's the only common thing I can find that differs between the machines.

The following are the error messages I receive, and it doesn't matter whether I use the IP address of the LS-QVL or the Network name \\NAS1

From File Explorer:
Windows cannot access \\nas1
Check the spelling of the name. Otherwise, there might be a problem with your network. To try to identify and resolve the problems, click Diagnose.
Error code: 0x80004005
Unspecified Error

From Windows Key + R
The specified server cannot perform the requested operation

I am at a loss here, my personal laptop connected to the same network works after I implented the changes as specified in this thread. No other Azure AD connected machines can access the device. And we are all connected to the same exact network.

UPDATE: I reinstalled the OS on the test machine. I chose Personal Use instead of Work use so it did not join the Azure AD domain. Now I can access the Share, this means there is a setting in Azure AD somewhere that locks down access to this share. Why I don't know, but it's locking the domain systems out.
« Last Edit: May 15, 2018, 12:45:25 pm by mparker »

vpaul11

  • Calf
  • *
  • Posts: 3
Anyone know how to enable SMB2 on a TS-6VHLB16 Terastation? I am open to any ideas. Thanks

awafa01

  • Calf
  • *
  • Posts: 3
mishikal

I have the Buffalo drive at home and was following your instructions and i believe i may have accidentally deleted the line before the section you outlined. Everything is still working but i just want to be safe. Would it be possible for you to paste the contents of that entire section once you make the necessary changes for SMB2.

I'm sorry, I've never used SSH/Putty before.  :-[

I need the lines before this:
/usr/local/sbin/nas_configgen -c samba
        if [ $? -ne 0 ]; then
                echo "$0 configure fail"
                exit 1
        fi
        /bin/sed -i '3i\\
    min protocol = SMB2\\
    max protocol = SMB2\\
        ' /etc/samba/smb.conf

oxygen8

  • Buffalo
  • ***
  • Posts: 243
  • Giving you some breathing space.
FW 1.74
smb.sh

Quote

#! /bin/sh
#

SMBDOPTIONS="-D"
NMBDOPTIONS="-D"
WINBINDDOPTIONS="-D"
PAMSMBDOPTIONS=
RETVAL=0
USE_MSDFS=1

SMBD_PID_FILE="/var/run/smbd.pid"
NMBD_PID_FILE="/var/run/nmbd.pid"

# this is used by daemonwatch
ACTIVE_FILE=/var/run/active_smb

if [ -f /etc/melco/info ]; then
   . /etc/melco/info
fi

[ -f /etc/nas_feature ] && . /etc/nas_feature

if [ "${SUPPORT_ISCSI}" = "1" ] && [ "${DEFAULT_WORKINGMODE}" = "iSCSI" ]; then
   echo "Not support samba on this model." > /dev/console
   exit 0
fi

if [ -f /usr/local/lib/libfseventmon.so ] ; then
   LDPRELOAD_SHARED_LIB=/usr/local/lib/libfseventmon.so
else
   LDPRELOAD_SHARED_LIB=/usr/local/lib/libondemandsync.so
fi

configure()
{
   ## built-in account(admin / guest) passwd db check.
   pdb_check=`/usr/local/bin/pdbedit -L |grep ^admin:`
   if [ "${pdb_check}" = "" ] ; then
      echo -e 'password\npassword\n' | /usr/local/bin/smbpasswd -as admin
      echo -e '\n\n' | /usr/local/bin/smbpasswd -as guest
   fi

   ## configure files from Buffalo parameters.
   echo "configure samba"
   
   # for active directory logon
   if [ "$domain" == "ad" ] ; then
      /usr/local/bin/create_krbconf.sh ${pdc} ${ad_dns}
      /etc/init.d/sethostname.sh
   fi
   
   touch /etc/printcap
   /usr/local/sbin/nas_configgen -c samba
   if [ $? -ne 0 ]; then
      echo "$0 configure fail"
      exit 1
   fi
/bin/sed -i '3i max protocol = SMB2' /etc/samba/smb.conf
}

setdown_msdfs()
{
   if [ -f /etc/melco/msdfs ] ; then
      . /etc/melco/msdfs
   else
      return 1
   fi
   
   rm -f ${msdfs_root_path:-/mnt/msdfs_root}/* > /dev/null
   if [ $? -eq 0 ] ; then
      return 0
   else
      return 1
   fi
}

setup_msdfs()
{
   if [ -f /etc/melco/msdfs ] ; then
      cat /etc/melco/msdfs |sed -e "s/\\\\\$//g" |sed -e "s/\\\\/\\\\\\\\/g" > /tmp/msdfs.tmp
      . /tmp/msdfs.tmp
      rm /tmp/msdfs.tmp
   else
      return 1
   fi

   if [ "${msdfs_function}" != "on" ] ; then
      return 1
   fi

   RETVAL=0   
   case ${msdfs_root_as_link} in
   on)
      ;;
   off)
      if [ -f ${msdfs_root_path} ] ; then
         mkdir -m 777 ${msdfs_root_path} -p
         if [ ! $? -eq 0 ] ; then
            return 1
         fi
      fi
      COUNTER=1
      for MSDFS_LINK_NAME in "${msdfs_link1_name}" "${msdfs_link2_name}" "${msdfs_link3_name}" "${msdfs_link4_name}" "${msdfs_link5_name}" "${msdfs_link6_name}" "${msdfs_link7_name}" "${msdfs_link8_name}"
      do
         if [ "${MSDFS_LINK_NAME}" != "" ] ; then
            case ${COUNTER} in
            1)
               ln -s msdfs:${msdfs_link1_unc1} ${msdfs_root_path}/${MSDFS_LINK_NAME}
               ;;
            2)
               ln -s msdfs:${msdfs_link2_unc1} ${msdfs_root_path}/${MSDFS_LINK_NAME}
               ;;
            3)
               ln -s msdfs:${msdfs_link3_unc1} ${msdfs_root_path}/${MSDFS_LINK_NAME}
               ;;
            4)
               ln -s msdfs:${msdfs_link4_unc1} ${msdfs_root_path}/${MSDFS_LINK_NAME}
               ;;
            5)
               ln -s msdfs:${msdfs_link5_unc1} ${msdfs_root_path}/${MSDFS_LINK_NAME}
               ;;
            6)
               ln -s msdfs:${msdfs_link6_unc1} ${msdfs_root_path}/${MSDFS_LINK_NAME}
               ;;
            7)
               ln -s msdfs:${msdfs_link7_unc1} ${msdfs_root_path}/${MSDFS_LINK_NAME}
               ;;
            8)
               ln -s msdfs:${msdfs_link8_unc1} ${msdfs_root_path}/${MSDFS_LINK_NAME}
               ;;
            esac
            if [ ! $? -eq 0 ] ; then
               RETVAL=1
            fi
         fi
         COUNTER=$(($COUNTER + 1))
      done
      ;;
   esac
   return ${RETVAL}
}

start_smbd()
{
   echo "Starting SMB services: "
   if [ ${smb:-"on"} = "off" ] ; then
      return 1
   fi
   if [ "${SUPPORT_REPLICATION}" = "1" ] ; then
      local is_rep_task=1
      if [ -f /usr/local/lib/libreplication ] ; then
         . /usr/local/lib/libreplication
         IsReplicationTask
         is_rep_task=$?
      fi
      if [ ${is_rep_task} -eq 0 ] ; then
         /usr/local/sbin/smbd $SMBDOPTIONS
      else
         LD_PRELOAD=${LDPRELOAD_SHARED_LIB} /usr/local/sbin/smbd $SMBDOPTIONS
         ret=$?
         if [ ${ret} -ne 0 ] ; then
            /usr/local/sbin/smbd $SMBDOPTIONS
            if [ ! -f /home/replication_error_occurred ] ; then
               /usr/local/bin/lcd_error_man.sh replication_error on buzzer_on
            fi
         fi
      fi
   else
      /usr/local/sbin/smbd $SMBDOPTIONS
   fi
   return $?
}

start_nmbd()
{
   echo "Starting NMB services: "
   if [ "${SUPPORT_REPLICATION}" = "1" ] ; then
      local is_rep_task=1
      if [ -f /usr/local/lib/libreplication ] ; then
         . /usr/local/lib/libreplication
         IsReplicationTask
         is_rep_task=$?
      fi
      if [ ${is_rep_task} -eq 0 ] ; then
         /usr/local/sbin/nmbd $NMBDOPTIONS
      else
         LD_PRELOAD=${LDPRELOAD_SHARED_LIB} /usr/local/sbin/nmbd $NMBDOPTIONS
         ret=$?
         if [ ${ret} -ne 0 ] ; then
            /usr/local/sbin/nmbd $NMBDOPTIONS
         fi
      fi
   else
      /usr/local/sbin/nmbd $NMBDOPTIONS
   fi
   return $?
}

start()
{
   configure
   if [ $USE_MSDFS -eq 1 ]; then
      echo -n "Setting up msdfs symbolic links..."
      setup_msdfs
      if [ $? -eq 0 ] ; then
         echo " [Success]"
      else
         echo " [Failed ]"
      fi
   fi

   start_smbd
   RETVAL=$?

   start_nmbd
   RETVAL2=$?

   [ $RETVAL -eq 0 -a $RETVAL2 -eq 0 ] && touch /var/lock/subsys/smb || \
      RETVAL=1
   touch $ACTIVE_FILE
   return $RETVAL
}

start_winbindd()
{
   RETVAL=0
   if [ "$domain" = "on" -o "$domain" = "ad" ] ; then
      echo "Starting WINBIND services: "
      /usr/local/sbin/winbindd $WINBINDDOPTIONS
      RETVAL=$?
      echo
      [ $RETVAL -eq 0 ] && touch /var/lock/subsys/winbindd
   fi
   return $RETVAL
}

start_pamsmbd()
{
   RETVAL=0
   if [ "$domain" = "server" ] ; then
      echo $"Starting PAMSMBD services: "
      /usr/local/sbin/pamsmbd $PAMSMBDOPTIONS
      RETVAL=$?
      echo
      [ $RETVAL -eq 0 ] && touch /var/lock/subsys/pamsmbd
   fi
   return $RETVAL
}

stop_smbd()
{
   echo "Shutting down SMB services: "
   killall smbd
   return $?

}

check_smbd()
{
   if ! ps -w |grep smbd; then
      return
   fi
   local t_pid=""
   pid=`ps -w |grep smbd|awk '{print $1}'`
   for i in ${pid}
   do
      t_pid="${t_pid} ${i}"
   done
   kill -9 ${t_pid}
}

stop_nmbd()
{
   echo "Shutting down NMB services: "
   killall nmbd
   return $?
}

stop()
{
   stop_smbd
   RETVAL=$?

   check_smbd

   stop_nmbd
   RETVAL2=$?

   [ $RETVAL -eq 0 -a $RETVAL2 -eq 0 ] && rm -f /var/lock/subsys/smb
   echo ""
   if [ $USE_MSDFS -eq 1 ]; then
      echo -n "Cleanup msdfs symbolic links..."
      setdown_msdfs
      if [ $? -eq 0 ] ; then
         echo " [Success]"
      else
         echo " [Failed ]"
      fi
   fi
   echo ""
   rm -f $ACTIVE_FILE
   return $RETVAL
}

stop_winbindd()
{
   echo "Shutting down WINBIND services: "
   killall winbindd
   RETVAL=$?
   echo
   [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/winbindd
   return $RETVAL
}

stop_pamsmbd()
{
   echo "Shutting down PAMSMBD services: "
   killall pamsmbd
   RETVAL=$?
   echo
   [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/pamsmbd
   return $RETVAL
}

restart()
{
   stop
   stop_winbindd
   stop_pamsmbd
   start
   start_winbindd
   start_pamsmbd
}

restart_nmbd()
{
   # check if smbd is alive or not.
   # if smbd is not alive, this routine do not anything.
   SMBD_PID=0
   if [ -e ${SMBD_PID_FILE} ] ; then
      SMBD_PID=`cat ${SMBD_PID_FILE}`
   fi

   if [ ${SMBD_PID} -gt 0 ] ; then
      # check if pid were really smbd's or not.
      SMBD_EXIST=`ps |grep ${SMBD_PID}|grep smbd`
      if [ "${SMBD_EXIST}" = "" ] ; then
         # pid file is exist, but that's wrong.
         return 1
      fi

      # check if it were alive or not.
      kill -CONT ${SMBD_PID}
      if [ $? -ne 0 ] ; then
         # sendsignal failed. maybe smbd not surviced.
         return 1
      fi
   else
      # maybe pid file not exist. = smbd not surviced.
      return 1
   fi

   stop_nmbd
   start_nmbd   

   return 0   
}

reload()
{
   echo -n $"Reloading smb.conf file: "
   configure
   killall -HUP smbd
   RETVAL=$?
   echo
   return $RETVAL
}

reload_winbindd()
{
   killall -HUP winbindd
   RETVAL=$?
   echo
   return $RETVAL
}

reload_pamsmbd()
{
   killall -HUP pamsmbd
   RETVAL=$?
   echo
   return $RETVAL
}

#
# Usage statement.
#

case "$1" in
   start)
      start
      start_winbindd
      start_pamsmbd
      ;;
   stop)
      stop
      stop_winbindd
      stop_pamsmbd
      ;;
   restart)
      restart
      ;;
   restart_nmbd)
      restart_nmbd
      ;;
   reload)
      reload
      reload_winbindd
      reload_pamsmbd
      ;;
   *)
      echo "usage: $0 {start|stop|restart|restart_nmbd|reload}"
      exit 1
      ;;
esac

awafa01

  • Calf
  • *
  • Posts: 3
Oxygen8 thank you soo much!

I believe I may have pooped something up. I can no longer SSH into the NAS. I can still access the drive and all its contents (which is very limited, only a few random files and some test files) since its mapped on my computer but i can't use putty nor can i log in through the web portal. Any ideas as to how i can get back in?

awafa01

  • Calf
  • *
  • Posts: 3
Phew! Ok i got everything working again.

Had to get the LS into Engineering/Emergency Mode so that NasNavigator could see it and then had to use the flash tool to reflash the latest firmware.

I followed the above steps properly this time but when i try to map the LS i get a message on windows saying i need to create a folder called Share on the LS so that i can map it, I already have a few folders on the LS so not sure why it needs another, anyone have any experience with that message.

I'm able to see it on NasNavigator but cant map it. I tried creating the folder called Share, but that still didn't help.

WonkoTheSane

  • Calf
  • *
  • Posts: 1
Thank you, mishikal!  I'm not sure how you figured out to do that, but it worked perfectly!

I just wanted to note that if you're using windows 10, do NOT use the OpenSSH that's installed through Manage Optional Features.  This version of OpenSSH doesn't have the old cypher needed to connect to the NAS, and based on what I'm reading as of 6/24/2018, there's no way to enable them.

I had to download and install PuTTY to connect.

It took me about an hour to figure that little puzzle out, and then about 5 minutes to follow the instructions and activate SMB2.