SMB2 forcing Strange behavior on UCS

[kevin.riedl]

Greatings Community,

i did a migration from SBS2011 to UCS these days and I’m now in the hardening task.
I noticed a strange behavior which i can’t understand.

UCS and security hardening

UCS Security Hardening - A Collection This is a collection of security related best practices and configurations for Univention Corporate Server. The first draft of this guide originated from a project with a customer to make UCS compliant with the Payment Card Industry Data Security Standard (PCI DSS). All mentioned PCI DSS requirements refer to version 3.2 of PCI DSS. The security requirements of PCI DSS can of course also be used as a guideline for organisations that don’t deal with payment …

If i set the ucr set samba/min/protocol=‘SMB2’
and ucr set samba/client/min/protocol=‘SMB2’

or equal to it create and link GPO’s via RSAT
the UCS is not recognized anymore in the Network. If you claw the Computer via adressline you can see and operate in the shares as well. The Windows Clients (with shared Directorys) show up as normal after forcing the policys.

Erkennen, aktivieren und Deaktivieren von SMBv1, SMBv2 und SMBv3 in Windows

Could somebody light me the way?

Best regards Kevin

Grüße an die Community

ich habe die letzten Tage die Migration von SBS2011 zu UCS vollzogen und befinde mich momentan in der Härtungsphase.

Ich hab mich hier an die Empfehlung von Grandjean gehalten:

UCS and security hardening

UCS Security Hardening - A Collection This is a collection of security related best practices and configurations for Univention Corporate Server. The first draft of this guide originated from a project with a customer to make UCS compliant with the Payment Card Industry Data Security Standard (PCI DSS). All mentioned PCI DSS requirements refer to version 3.2 of PCI DSS. The security requirements of PCI DSS can of course also be used as a guideline for organisations that don’t deal with payment …

Nun tritt aber ein merkwürdiges Verhalten auf, wenn die folgendne UCR’s gesetzt werden

ucr set samba/min/protocol=‘SMB2’
ucr set samba/client/min/protocol=‘SMB2’

und die Richtlinien angenommen werden verschwindet der UCS aus der Netzwerkumgebung (Netzwerkerkennung).

Dies passiert auch wenn man stattdessen das ganze via GPO’ mit RSAT erstellt und verknüpft

Erkennen, aktivieren und Deaktivieren von SMBv1, SMBv2 und SMBv3 in Windows

Der UCS ist dennoch erreichbar auch kann man weiterhin auf die Shares zugreifen wenn man den Rechner direkt in der Adresszeile ansteuert.

Dieses Verhalten zeigt sich aber nicht bei Windows-Maschinen mit Freigaben, diese sind auch nach Force SMB2 weiter sichtbar.

Kann mich hier jemand erleuchten?

Beste Grüße
Kevin

[externa1]

there is no more network discovery with smb2 or smb3
Windows Systems are using WS-Discovery (WSD) instead which is not part of samba this time, so windows systems are still able to discover other windows systems in the network Neighbourhood but no samba servers

freenas/truenas has an implementation that works also for samba, but i did not test if this is usable on UCS too as i don’t need the network browsing for shares (they are all mapped through GPO)

here is a good description for that:

How to kill off SMB1, NetBIOS, WINS and *still* have Windows' Network...

rg
Christian

[kevin.riedl]

Hi externa1 and thank you for your KISS-Answer

I understand, what you mean with the mapped drives via GPO, but for my needs it isn’t necessary that the user can see the drive. Thats only shares for GPOs and roaming profiles. And thats the snag, if the Windows Client doesn’t recognize the Server there is trouble with syncing the GPO’s and also the profiles, thats what Eventviewer tells me.

best regards
Kevin