AdminSysGNULinux

Outils pour utilisateurs

Outils du site

Piste : • blog
tech:samba-client_smb_cifs

Différences

Ci-dessous, les différences entre deux révisions de la page.

Lien vers cette vue comparative

Les deux révisions précédentesRévision précédente
Prochaine révision		Révision précédente
tech:samba-client_smb_cifs [2025/05/06 16:27] – Jean-Baptistetech:samba-client_smb_cifs [2026/06/30 21:53] (Version actuelle) – Jean-Baptiste
Ligne 1: Ligne 1:
 +<!DOCTYPE markdown>
 +{{tag>FS Windows Réseau}}
 +
 +# Client Samba SMB CIFS
 +
 +Voir aussi 
 +* [[Serveur Samba SMB CIFS]]
 +* CIFS Unix Extensions / Services for Unix (SFU)
 +
 +
 +Voir :
 +* rclone
 +* curl smb / smbs
 +
 +
 +## Install
 +
 +~~~bash
 +apt-get install cifs-utils smbclient
 +~~~
 +
 +
 +## Exemple 
 +
 +`auth.cfg`
 +~~~ini
 +username=jean
 +password=P@ssw0rd
 +domain=D$
 +~~~
 +
 +~~~bash
 +smbclient -A auth.cfg //192.168.1.12/D$/ -c ls
 +~~~
 +
 +
 +### Lister les partages
 +
 +Anonymement
 +~~~bash
 +smbclient -N -L 127.0.0.1
 +~~~
 +
 +Avec un compte
 +~~~bash
 +smbclient -U utilisateur%mdp -L 127.0.0.1
 +~~~
 +
 +Ou (debug)
 +~~~bash
 +smbtree -N -d3
 +~~~
 +
 +
 +### Se connecter
 +
 +#### smbclient
 +
 +~~~bash
 +smbclient -U utilisateur%mdp '\\127.0.0.1\partage'
 +~~~
 +
 +
 +#### gvfs-mount
 +
 +~~~bash
 +gvfs-mount smb://server/share
 +~~~
 +
 +#### libpam-mount
 +
 +~~~bash
 +apt-get install libpam-mount
 +~~~
 +
 +
 +`/etc/security/pam_mount.conf.xml`
 +~~~xml
 +<volume options= "user=%(DOMAIN_USER),dom=%(DOMAIN_NAME),setuids" fstype="cifs" server="192.168.x.x" path="sharename" mountpoint="~/sharemount" />
 +~~~
 +
 +
 +## Sécurité / Hardening / pentest
 +
 +Voir nmap, smbmap, rpcclient, nbtscan, enum4linux
 +* https://www.infosecademy.com/nmap-smb-scripts-enumeration/
 +
 +Pour tester
 +~~~bash
 +nmap -A 127.0.0.1
 +
 +nmap --script smb-os-discovery.nse -p445 127.0.0.1
 +sudo nmap -sU -sS --script smb-os-discovery.nse -p U:137,T:139 127.0.0.1
 +
 +nmap --script smb-enum-shares.nse -p445 <host>
 +sudo nmap -sU -sS --script smb-enum-shares.nse -p U:137,T:139 127.0.0.1
 +
 +nmap --script smb-enum-users.nse -p445 <host>
 +sudo nmap -sU -sS --script smb-enum-users.nse -p U:137,T:139 127.0.0.1
 +~~~
 +
 +Disable less secure legacy dialects
 +
 +`/etc/modprobe.d/cifs.conf`
 +~~~bash
 +options cifs disable_legacy_dialects=1
 +~~~
 +
 +~~~bash
 +echo 1 > /sys/module/cifs/parameters/disable_legacy_dialects
 +
 +# Y or 1  stands for enabled
 +# N or 0 stands for disabled
 +~~~
 +
 +
 +## Autres clients
 +
 +Display CIFS statics with Mega bytes per a 1 second 3 times (sysstat)
 +~~~bash
 +cifsiostat -m 1 3 
 +~~~
 +
 +
 +
 +### Userland
 +
 +Equiv : 
 +~~~
 +mount.cifs -o credentials=/home/share/.auth.cfg,uid=1000,forceuid,gid=1000,forcegid,file_mode=0777,dir_mode=0777,noperm,port=1446,vers=2.0  //127.0.0.1/share /mnt/share/
 +~~~
 +
 +~~~bash
 +#sudo apt-get install fusesmb
 +sudo apt-get install smbnetfs 
 +
 +mkdir .smb
 +cp /etc/smbnetfs.conf ~/.smb/
 +chmod 600 ~/.smb/smbnetfs.conf
 +cp /etc/samba/smb.conf ~/.smb/
 +mkdir -p Network
 +smbnetfs Network
 +
 +cd Network/127.0.0.1:1446/
 +
 +
 +cd Network/share:'domain\user1':'P@ssw0rd'@127.0.0.1:1446/Install
 +~~~
 +
 +`~/.smb/smbnetfs.conf`
 +~~~
 +log_file                "/tmp/smbnetfs.log"
 +show_$_shares           "true"
 +show_hidden_hosts       "true"
 +auth                    "guest" ""
 +include                 "smbnetfs.auth"
 +~~~
 +
 +`~/.smb/smbnetfs.auth`
 +~~~
 +auth "smb-sh"           "DOMAIN/user1" "P@ssw0rd"
 +auth "127.0.0.1"        "DOMAIN/user1" "P@ssw0rd"
 +auth "127.0.0.1:1446"   "DOMAIN/user1" "P@ssw0rd"
 +~~~
 +
 +~~~bash
 +chmod 600 ~/.smb/smbnetfs.auth
 +~~~
 +
 +
 +## Cache avec cachefilesd / FS-Cache
 +
 +Voir :
 +* https://lars.timmann.de/wiki/index.php?title=Cachefilesd
 +* https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/managing_file_systems/getting-started-with-fs-cache_managing-file-systems
 +* https://www.kernel.org/doc/html/latest/filesystems/caching/cachefiles.html
 +* https://serverfault.com/questions/602203/cachefilesd-cachefiles-everything-seems-to-be-set-up-still-not-working
 +
 +
 +## Autres
 +
 +
 +~~~bash
 +findmnt -n -s -t cifs
 +~~~
 +
 +~~~bash
 +mkdir /mnt/nompartage
 +~~~
 +
 +`/etc/fstab`
 +~~~
 +//ouindoze/nompartage    /mnt/nompartage    cifs    credentials=/home/jean/.smbcredentials,rw,auto,user,nounix,noserverino,iocharset=utf8,file_mode=0777,dir_mode=0777 0 0
 +
 +//public/plop /mnt/espace_build_ovs/ cifs _netdev,rw,uid=15041,forceuid,gid=15141,forcegid,file_mode=0777,dir_mode=0777,noperm,credentials=/etc/.cifs_public_plop 0 0
 +~~~
 +
 +~~~bash
 +mount -t cifs //mystorage/data2 -o username=user1,password=myPassword,rw,bg,vers=3,proto=tcp,hard,intr,rsize=32768,wsize=32768,forcedirectio,llock /data2
 +~~~
 +
 +
 +`/etc/modprobe.d/cifs.conf`
 +~~~bash
 +# Disable caching and the CIFS oplog for stable NTFS network shares
 +options cifs enable_oplocks=0
 +
 +install cifs /sbin/modprobe --ignore-install cifs $CMDLINE_OPTS && echo 0 > /proc/fs/cifs/LinuxExtensionsEnabled && echo 0 > /proc/fs/cifs/LookupCacheEnabled
 +remove cifs /sbin/modprobe -r cifs
 +~~~
 +
 +Fichiers contenant les identifiants en clair (pour ne pas les mettre dans le fstab)
 +
 +`/etc/.cifs_public_plop`
 +~~~ini
 +#domain=domain
 +username=utilisateur
 +password=motdepasse
 +~~~
 +
 +`/home/jean/.smbcredentials`
 +~~~ini
 +username=utilisateur
 +password=motdepasse
 +~~~
 +
 +Vous pouvez éventuellement ajouter : \
 +`domain=MONDOMAINE`
 +
 +Ou encore le mettre après le "username" comme : \
 +`username=utilisateur@MONDOMAINE`
 +
 +ou bien \
 +`username=MONDOMAINE\utilisateur`
 +
 +~~~bash
 +chmod 600 /home/jean/.smbcredentials /etc/.cifs_public_plop
 +~~~
 +
 +Puis
 +~~~bash
 +mount /mnt/nompartage
 +~~~
 +
 +
 +## Pb
 +
 +### Démonter / libérer les partitions CIFS en erreur (ou non)
 +
 +
 +~~~
 +# mount | grep /mnt/shared
 +systemd-1 on /mnt/shared type autofs (rw,relatime,fd=28,pgrp=1,timeout=10,minproto=5,maxproto=5,direct,pipe_ino=38828)
 +~~~
 +
 +
 +~~~bash
 +sudo umount -a -t cifs -l
 +sudo umount -a -t autofs -l
 +~~~
 +
 +
 +### Err NT_STATUS_LOGON_FAILURE (with authfile only)
 +
 +Voir https://bugzilla.redhat.com/show_bug.cgi?id=78846
 +
 +
 +~~~
 +# smbclient -A /etc/.creds //server-smb/partage1/
 +session setup failed: NT_STATUS_LOGON_FAILURE
 +~~~
 +
 +~~~
 +# rpcclient vmx-gspl -d 1 -A /etc/.creds -c "getdriverdir \"Windows NT x86\""
 +Cannot connect to server.  Error was NT_STATUS_LOGON_FAILURE
 +~~~
 +
 +~~~
 +# smbclient -U jean -W DOMAIN //server-smb/partage1/
 +Enter jean's password:
 +Domain=[ACME] OS=[Unix] Server=[Samba 3.6.6]
 +smb: \>
 +~~~
 +
 +
 +### Err NT_STATUS_CONNECTION_DISCONNECTED
 +
 +~~~
 +$ smbclient -U user%'P@ssw0rd' -p 1445 //127.0.0.1/E
 +WARNING: The "syslog" option is deprecated
 +protocol negotiation failed: NT_STATUS_CONNECTION_DISCONNECTED
 +~~~
 +
 +#### Solution
 +
 +Ajouter `-m SMB3` ou ajouter `--option='client min protocol=NT1`
 +
 +~~~bash
 +smbclient -U user%'P@ssw0rd' -p 1445 //127.0.0.1/E -m SMB3
 +
 +smbclient -U user%'P@ssw0rd' -p 1445 //127.0.0.1/E --option='client min protocol=NT1'
 +~~~
 +
 +
 +### Pb temps de connexion long - NTLMSSP
 +
 +~~~
 +plop@portable:~$ smbclient -U user%'P@ssw0rd' -p 1445 //127.0.0.1/D -m SMB3 -d 3
 +lp_load_ex: refreshing parameters
 +Initialising global parameters
 +rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
 +Processing section "[global]"
 +WARNING: The "syslog" option is deprecated
 +added interface wlan0 ip=2a01:cb04:bae:2600:9aea:4ae:b4b3:15a2 bcast= netmask=ffff:ffff:ffff:ffff::
 +added interface docker0 ip=172.17.42.1 bcast=172.17.255.255 netmask=255.255.0.0
 +added interface wlan0 ip=192.168.1.12 bcast=192.168.1.255 netmask=255.255.255.0
 +Client started (version 4.5.16-Debian).
 +Connecting to 127.0.0.1 at port 1445
 +Doing spnego session setup (blob length=398)
 +got OID=1.3.6.1.4.1.311.2.2.30
 +got OID=1.2.840.48018.1.2.2
 +got OID=1.2.840.113554.1.2.2
 +got OID=1.2.840.113554.1.2.2.3
 +got OID=1.3.6.1.4.1.311.2.2.10
 +got principal=not_defined_in_RFC4178@please_ignore
 +GENSEC backend 'gssapi_spnego' registered
 +GENSEC backend 'gssapi_krb5' registered
 +GENSEC backend 'gssapi_krb5_sasl' registered
 +GENSEC backend 'spnego' registered
 +GENSEC backend 'schannel' registered
 +GENSEC backend 'naclrpc_as_system' registered
 +GENSEC backend 'sasl-EXTERNAL' registered
 +GENSEC backend 'ntlmssp' registered
 +GENSEC backend 'ntlmssp_resume_ccache' registered
 +GENSEC backend 'http_basic' registered
 +GENSEC backend 'http_ntlm' registered
 +GENSEC backend 'krb5' registered
 +GENSEC backend 'fake_gssapi_krb5' registered
 +Got challenge flags:
 +Got NTLMSSP neg_flags=0x62898215
 +NTLMSSP: Set final flags:
 +Got NTLMSSP neg_flags=0x62088215
 +NTLMSSP Sign/Seal - Initialising with flags:
 +Got NTLMSSP neg_flags=0x62088215
 +
 +
 +
 +NTLMSSP Sign/Seal - Initialising with flags:
 +Got NTLMSSP neg_flags=0x62088215
 +Domain=[PLOP] OS=[] Server=[]
 +smb: \>
 +~~~
 +
 +Où il y a trois lignes vides, ça a mis plusieurs secondes. \
 +Dans le cas présent le contrôleur de domaine n'est pas joignable et nous utilisons un compte local. 
 +
 +
 +#### Solution
 +
 +Spécifier le domaine "." \
 +Le point indique un compte local (hors du domaine) \
 +Vous pouvez utiliser l'option `-W`
 +
 +~~~bash
 +smbclient -U user%'P@ssw0rd' -p 1445 //127.0.0.1/D -m SMB3 -W .
 +~~~
 +
 +
 +#### Solution
 +
 +Mettre à jour smbclient et ses dépendances
 +~~~
 +# apt-get install smbclient
 +The following extra packages will be installed:
 +  libldb1 libsmbclient samba-common samba-libs
 +~~~
 +
 +### Pb CIFS VFS: cifs_mount failed w/return code = -61 - NT_STATUS_PATH_NOT_COVERED
 +
 +Erreur
 +~~~
 +# dmesg
 +[1231082.766925] CIFS VFS: cifs_mount failed w/return code = -61
 +~~~
 +
 +Diag
 +~~~
 +# smbclient -U jean -W ACME \\partages\images
 +
 +smb: \> cd REP\                                                     
 +Connection to pc1111 failed (Error NT_STATUS_BAD_NETWORK_NAME)           
 +Unable to follow dfs referral [\pc1111\REP$]                        
 +cd \REP\: NT_STATUS_PATH_NOT_COVERED                                 
 +
 +
 +# ping pc1111                        
 +ping: unknown host pc1111
 +~~~
 +
 +##### Solution
 +
 +Modifier le `/etc/hosts` ou `/etc/resolv.conf` afin de résoudre pc1111
 +
 +### Pb error(22): Invalid argument
 +
 +~~~
 +# mount -t cifs -o rw,uid=1000,forceuid,gid=1000,forceuid,file_mode=0777,dir_mode=0777,noperm,credentials=/root/.fichier_mdp //server/partage /mnt/nompartage
 +mount error(22): Invalid argument
 +Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg)
 +
 +# dmesg -T | tail
 +[Wed Dec 23 11:31:16 2020] CIFS: Attempting to mount //server/partage
 +[Wed Dec 23 11:31:16 2020] CIFS: VFS: cifs_mount failed w/return code = -22
 +~~~
 +
 +#### Solution
 +
 +Spécifier la version souhaitée
 +
 +Exemple : `vers=2.0`
 + 
 +~~~bash
 +mount -t cifs -o rw,uid=1000,forceuid,gid=1000,forcegid,file_mode=0777,dir_mode=0777,noperm,vers=2.0,credentials=/root/.fichier_mdp //server/partage /mnt/nompartage
 +~~~
 +
 +### Err NT_STATUS_LOGON_FAILURE
 +
 +~~~
 +$ smbclient -U user1%'BasP@ssw0rd' '\\localhost\shared'
 +session setup failed: NT_STATUS_LOGON_FAILURE
 +
 +$ smbclient -U user1%'P@ssw0rd' '\\localhost\shared'
 +Domain=[localhost] OS=[Unix] Server=[Samba 3.0.33-3.7.el5]
 +tree connect failed: NT_STATUS_BAD_NETWORK_NAME
 +~~~
 +
 +#### Solution
 +
 +Le partage pointait vers un dossier non existant.
 +
 +
 +## Notes
 +
 +Exemple options de montage 
 +
 +~~~
 + on /data/users_homedirs type cifs (rw,relatime,sec=ntlm,unc=\\serveur\Home$,username=utilisateur,domain=ACME,uid=1000,forceuid,gid=1000,forcegid,addr=192.168.1.20,file_mode=0755,dir_mode=0755,nounix,rsize=61440,wsize=65536,actimeo=1)
 +~~~
 +
  
Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki