SMB security - server signing

[Paul042020]

Hello,
On this page of the Truenas documentation about security optimizations (https://www.truenas.com/docs/solutions/optimizations/security/#smb), it is written :

SMB Server Signing is recommended. To enable Server Signing, go to Services > SMB > Edit > Auxiliary Parameters and add this string to the Auxilary Parameters field:
server signing = mandatory

If it is recommended, why is it not a default setting ?
Do you think it is a good thing to add this setting if I access my personal data through a VPN ?

Regards

 

[anodos]

Hello,
On this page of the Truenas documentation about security optimizations (https://www.truenas.com/docs/solutions/optimizations/security/#smb), it is written :


If it is recommended, why is it not a default setting ?
Do you think it is a good thing to add this setting if I access my personal data through a VPN ?

Regards

I've raised an issue with our documentation team. Signing is non-optional for SMB2/3 protocol. That aux param is not needed and provides basically zero benefit (except possibly in case where SMB1 is used -- that's debatable because SMB1 usage itself is actively discouraged).

 

[Paul042020]

Hello and thank you for your quick response

If I understand your answer: there is already a signature for the SMB2 and 3 protocol, which makes adding this parameter unnecessary.
Is it really that ?

If this is the case, the documentation is indeed confusing

 

[anodos]

Hello and thank you for your quick response

If I understand your answer: there is already a signature for the SMB2 and 3 protocol, which makes adding this parameter unnecessary.
Is it really that ?

If this is the case, the documentation is indeed confusing

smb.conf

For the SMB2 protocol, by design, signing cannot be disabled. In the case where SMB2 is negotiated, if this parameter is set to disabled, it will be treated as auto. Setting it to mandatory will still require SMB2 clients to use signing.

As I mentioned that documentation is getting fixed.

 

[Paul042020]

ok thank you.
I remove this parameter

 

[paulpop]

Hi, I´ve a doubt.

Actually with the parameter (server signing = mandatory) or not the testing result is the same "Message signing enabled but not required" How can I make the result of the test with nmap to be "Message signing enabled and required"? What parameters should I use? Because I have used different ones in different combinations and the result is the same.