SMBv1 not getting disabled

[m9x3mos]

Hello All,
I am currently using TrueNAS-12.0-U3.1 on one of my systems and my main system is still on Freenas 11.3-U5.
I have done a network scan for SMB protocols and found that SMBv1 is still enabled for both systems even though it is disabled in the GUI.
No matter what changes I have tried or Aux Parameters, I can't seem to get it to go away. How can I fully disable SMBv1?

Here is the settings I have on the truenas machine

the entire aux params list is:
min protocol = smb3
max protocol = smb3
client min protocol = smb3
client max protocol = smb3
server min protocol = smb3
server max protocol = smb3

And when I scan the two systems, this is what is coming up

Any help would be greatly appreciated.

 

[anodos]

Sounds like a broken tool. Can you do a real-life SMB1 connection to the server? (i.e. not through the tool) You can set "client min protocol=NT1" as an auxiliary parameter under Services->SMB, then try "smbclient //127.0.0.1/<share-name> -m NT1 -U <your username>".

 

[m9x3mos]

Sounds like a broken tool. Can you do a real-life SMB1 connection to the server? (i.e. not through the tool) You can set "client min protocol=NT1" as an auxiliary parameter under Services->SMB, then try "smbclient //127.0.0.1/<share-name> -m NT1 -U <your username>".

I was able to test that and am getting different response for nt1 vs smb2

On SMB2 it is saying status not supported and kicking it out as expected.

but 1 is saying no compatible protocol selected by server and then invalid response.
Maybe this is something to do with that and why the tool is showing it more as active.

 

[m9x3mos]

Sounds like a broken tool. Can you do a real-life SMB1 connection to the server? (i.e. not through the tool) You can set "client min protocol=NT1" as an auxiliary parameter under Services->SMB, then try "smbclient //127.0.0.1/<share-name> -m NT1 -U <your username>".

This is the same as the response on the older FreeNAS 11 as well.

So with it coming back as invalid response instead of not supported, that is probably why that it is flagging it as available when it might not be.

 

[anodos]

Hmm... Can you do same test against a Windows server with SMB1 disabled?

 

[m9x3mos]

Hmm... Can you do same test against a Windows server with SMB1 disabled?

This is what happens going to a Windows 2019 server

 

[anodos]

Okay. Thanks for the details.