Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752674AbdIBCRC (ORCPT ); Fri, 1 Sep 2017 22:17:02 -0400 Received: from mail-pf0-f173.google.com ([209.85.192.173]:32948 "EHLO mail-pf0-f173.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751493AbdIBCQ7 (ORCPT ); Fri, 1 Sep 2017 22:16:59 -0400 X-Google-Smtp-Source: ADKCNb4vUJa21eHnhjJ92moRoYDPIvoqCfpPNGQZQz7Knur7vIQcanTo5xsSRqqO03ipr+z4I+f9sz9jsWhLzcFQzqk= MIME-Version: 1.0 In-Reply-To: References: <1504213298-27431-1-git-send-email-linux@leemhuis.info> <59A9A59E.6040205@tlinx.org> From: Steve French Date: Fri, 1 Sep 2017 21:16:38 -0500 Message-ID: Subject: Re: RFC: Revert move default dialect from CIFS to to SMB3 To: Linus Torvalds Cc: "L. A. Walsh" , Thorsten Leemhuis , Linux Kernel Mailing List , "linux-cifs@vger.kernel.org" , Pavel Shilovsky Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1822 Lines: 42 On Fri, Sep 1, 2017 at 2:45 PM, Linus Torvalds wrote: > On Fri, Sep 1, 2017 at 11:23 AM, L. A. Walsh wrote: >> Why be incompatible with the majority of Windows installations? >> I.e. If you really want to up security from 1.0 (not adverse to that), >> then why not go to 2.1 as used by Win7? Win7 is still in support >> from MS -- and they haven't indicated a need to upgrade to 3.x for >> security reasons. 3.x may have new security features, no argument, but >> that doesn't mean 2.1, is insecure. > > I'm certainly ok with changing the default to 2.1 if that helps people. > > Is that actually likely to help the people who now see problems with > the existing 3.0 default? > > I don't know the exact security issue details with cifs, but I _think_ > it was explicitly _only_ smb-1.0, right? The default was SMB1 (CIFS) and was recently changed to SMB3. The dialect still can be overridden by specifying "vers=1.0" or "vers=2.1" etc. on mount. We just put together a patch to better explain the default changes (with additional warning messages) as suggested. SMB3 is significantly better than SMB2.1 (supporting encrypted shares and sessions for example, and requiring support for "secure negotiate") and some servers require SMB3 minimum as a result, but it was agreed at the last test event to eventually support multi-dialect negotiation (for which SMB2.1 e.g. Windows 7, would be the oldest and least secure dialect we would support) but in this interim stage we had to pick one, and the improvements in SMB3 (over SMB2.1) tipped the balance. In 4.14 we will likely have the ability to more securely do multi-dialect negotiation, and this issue of SMB2.1 vs. SMB3 will be moot as the server will choose its most recent dialect. -- Thanks, Steve