PowerScale: OneFS: How to enable or disable SMB1 on a Cluster

Due to security concerns, Dell Technologies does not recommend enabling the SMBv1 protocol dialect in OneFS. To ensure long-term compatibility, consider transitioning away from this protocol.

To verify whether support for the SMB1 protocol is enabled or disabled, establish an SSH connection to a node and then run the following command:

isi_gconfig registry.Services.lwio.Parameters.Drivers.srv.SupportSmb1

If the reported value is a zero, then it is disabled. If the value reported is one, then it is enabled.

To disable support of SMBv1:

isi_gconfig registry.Services.lwio.Parameters.Drivers.srv.SupportSmb1=0

To enable support of SMBv1:

isi_gconfig registry.Services.lwio.Parameters.Drivers.srv.SupportSmb1=1

A refresh (or restart) of the SRV service on the cluster is required to implement changes for SMBv1 supportability.

Disabling support for the SMB1 protocol prevents new SMB1 connections from being established. Existing SMB1 connections are not disconnected even after disabling the feature.
 

A forced refresh of SRV can be done on a single node by connecting over SSH and doing the following:

/usr/likewise/bin/lwsm refresh srv

In rare circumstances, a restart of the SRV service is required. Do the following:

/usr/likewise/bin/lwsm restart srv

Admins may use isi_for_array -sX before the commands to refresh or restart SRV across the cluster. Ensure that the nested command is contained in quotes.

While the refresh of SRV is not impactful, restarting it may be. Plan for these actions in a maintenance window to mitigate disruption to clients. If administrators notice any issues with these actions, it is recommended that they engage Support for further assistance.

Starting in OneFS 9.6, the SMBv1 protocol is disabled by default. Microsoft has ended support for the protocol and there are numerous security concerns with it that have been addressed in newer dialects. A cluster using SMBv1 sees a disruption to their workflow postupgrade as a result. Admins can avoid this by manually enabling SMBv1 instead of relying strictly on the older default configuration. Setting SMBv1 to enabled marks the setting as "not inherited from defaults," ensuring no changes to that part of the configuration postupgrade.

To ensure that the value is manually enabled in OneFS 9.5 and earlier, follow the earlier steps to enable SMBv1 manually through the gconfig. Administrators should do this in a maintenance window to minimize disruption to SMBv1 clients. The command to enable SMBv1 with the gconfig in OneFS 9.5 and earlier is below:

isi_gconfig registry.Services.lwio.Parameters.Drivers.srv.SupportSmb1=1

Remember to validate that the value reports the value 1 back. Admins may disable then enable support for SMBv1 to confirm the value changes take effect. If there are plans to use SMBv1 prior to the upgrade after it is enabled, an SRV refresh or restart is required on all nodes. This is impactful to clients using SMB protocol regardless of which dialect is used.

If admins forget to explicitly enable SMBv1 on the cluster configuration prior to the upgrade, then the upgrade ensures it is set to disabled. Use the command below postupgrade to reenable support of SMBv1.

isi smb settings global modify --support-smb1=true

This may require a forced refresh or restart of services to have those changes take effect. It is recommended that any significant changes to the cluster configuration be done during a maintenance window to minimize impact. Administrators should begin planning the full deprecation of SMBv1 in their environment if they have not done so already.