我决定在 Samba 中切换到更高版本的 SMB（至少 2）——主要是出于安全原因。
我尝试在 [global] 部分中添加到 smb.conf 中：
client min protocol = SMB2
client max protocol = SMB3
server min protocol = SMB2
要不就
protocol=SMB2
每次尝试后我都重新启动了 samba 或整个服务器。但日志说：
[1970/01/01 01:01:12.085949, 0] smbd/negprot.c:706(reply_negprot)
No protocol supported !
[1970/01/01 01:01:13.153024, 0] smbd/negprot.c:706(reply_negprot)
No protocol supported !
[2018/11/04 12:10:25.080148, 0] param/loadparm.c:7997(lp_do_parameter)
Ignoring unknown parameter "server min protocol"
[2018/11/04 12:10:25.092055, 0] param/loadparm.c:7997(lp_do_parameter)
Ignoring unknown parameter "client min protocol"
[2018/11/04 12:10:30.803144, 0] param/loadparm.c:7997(lp_do_parameter)
Ignoring unknown parameter "server min protocol"
[2018/11/04 12:10:30.804260, 0] param/loadparm.c:7997(lp_do_parameter)
Ignoring unknown parameter "client min protocol"
我用 google 搜索了一下，注意到有些人也在 FSTAB 中配置 cufs。我想我没有这样做，它只是因为 smb.conf 才起作用。
这是我的 FSTAB：
roc /proc proc defaults 0 0
/dev/mmcblk0p1 /boot vfat defaults 0 2
/dev/mmcblk0p2 / ext4 defaults,noatime 0 1
UUID=34150b89-5e8b-4769-8b68-f403659c58f7 /media/USBHD auto defaults,_netdev 0 2
这是定义共享文件夹的 smb.conf 部分：
[USBHD]
comment=Dysk udostepniony
path = /media/USBHD
valid users = @users
force group = users
create mask = 0777
directory mask = 0777
read only = no
writeable = yes
browseable = yes
public = yes
我应该编辑 FSTAB 吗？如何？
什么时候可以像在 smb.conf 的 MAN 页中那样配置版本协议，什么时候需要在 FSTAB 中执行此操作？
我猜可能是最小协议在我使用的 Samba 版本中可能不可用。但无论如何，它支持SMB2协议，那么如何开启它呢？
Samba 版本 3.6.6
NAME="Raspbian GNU/Linux" VERSION_ID="7" VERSION="7（喘息）"
内核：4.1.19+
测试参数-v
Load smb config files from /etc/samba/smb.conf
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Unknown parameter encountered: "client min protocol"
Ignoring unknown parameter "client min protocol"
Unknown parameter encountered: "client max protocol"
Ignoring unknown parameter "client max protocol"
Processing section "[homes]"
Processing section "[printers]"
Processing section "[print$]"
Processing section "[USBHD]"
Loaded services file OK.
Server role: ROLE_STANDALONE
Press enter to see a dump of your service definitions
[global]
display charset = LOCALE
workgroup = WORKGROUP
realm =
netbios name = RASPBERRYPI
netbios aliases =
netbios scope =
server string = %h server
interfaces =
bind interfaces only = No
security = USER
auth methods =
encrypt passwords = Yes
client schannel = Auto
server schannel = Auto
allow trusted domains = Yes
map to guest = Bad User
null passwords = No
obey pam restrictions = Yes
password server = *
smb passwd file = /etc/samba/smbpasswd
private dir = /etc/samba
passdb backend = tdbsam
algorithmic rid base = 1000
root directory =
guest account = nobody
enable privileges = Yes
pam password change = Yes
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword: * %n\n *password\supdated\ssuccessfully* .
passwd chat debug = No
passwd chat timeout = 2
check password script =
username map =
password level = 0
username level = 0
unix password sync = Yes
restrict anonymous = 0
lanman auth = No
ntlm auth = Yes
raw NTLMv2 auth = No
client NTLMv2 auth = Yes
client lanman auth = No
client plaintext auth = No
client use spnego principal = No
send spnego principal = No
preload modules =
dedicated keytab file =
kerberos method = default
map untrusted to domain = No
log level = 2
syslog = 0
syslog only = No
log file = /var/log/samba/log.%m
max log size = 1000
debug timestamp = Yes
debug prefix timestamp = No
debug hires timestamp = Yes
debug pid = No
debug uid = No
debug class = No
enable core files = Yes
smb ports = 445 139
large readwrite = Yes
max protocol = SMB2
min protocol = CORE
min receivefile size = 0
read raw = Yes
write raw = Yes
disable netbios = No
reset on zero vc = No
log writeable files on exit = No
acl compatibility = auto
defer sharing violations = Yes
nt pipe support = Yes
nt status support = Yes
announce version = 4.9
announce as = NT
max mux = 50
max xmit = 16644
name resolve order = lmhosts wins host bcast
max ttl = 259200
max wins ttl = 518400
min wins ttl = 21600
time server = No
unix extensions = Yes
allow dcerpc auth level connect = No
use spnego = Yes
client signing = auto
server signing = No
client use spnego = Yes
client ldap sasl wrapping = sign
enable asu support = No
svcctl list =
deadtime = 0
getwd cache = Yes
keepalive = 300
lpq cache time = 30
max smbd processes = 0
paranoid server security = Yes
max disk size = 0
max open files = 16384
socket options = TCP_NODELAY
use mmap = Yes
hostname lookups = No
name cache timeout = 660
ctdbd socket =
cluster addresses =
clustering = No
ctdb timeout = 0
ctdb locktime warn threshold = 0
smb2 max read = 65536
smb2 max write = 65536
smb2 max trans = 65536
smb2 max credits = 8192
load printers = Yes
printcap cache time = 750
printcap name =
cups server =
cups encrypt = No
cups connection timeout = 30
iprint server =
disable spoolss = No
addport command =
enumports command =
addprinter command =
deleteprinter command =
show add printer wizard = Yes
os2 driver map =
mangling method = hash2
mangle prefix = 1
max stat cache size = 256
stat cache = Yes
machine password timeout = 604800
add user script =
rename user script =
delete user script =
add group script =
delete group script =
add user to group script =
delete user from group script =
set primary group script =
add machine script =
shutdown script =
abort shutdown script =
username map script =
username map cache time = 0
logon script =
logon path = \\%N\%U\profile
logon drive =
logon home = \\%N\%U
domain logons = No
init logon delayed hosts =
init logon delay = 100
os level = 20
lm announce = Auto
lm interval = 60
preferred master = No
local master = Yes
domain master = Auto
browse list = Yes
enhanced browsing = Yes
dns proxy = No
wins proxy = No
wins server =
wins support = No
wins hook =
kernel oplocks = Yes
lock spin time = 200
oplock break wait time = 0
ldap admin dn =
ldap delete dn = No
ldap group suffix =
ldap idmap suffix =
ldap machine suffix =
ldap passwd sync = no
ldap replication sleep = 1000
ldap suffix =
ldap ssl = start tls
ldap ssl ads = No
ldap deref = auto
ldap follow referral = Auto
ldap timeout = 15
ldap connection timeout = 2
ldap page size = 1024
ldap user suffix =
ldap debug level = 0
ldap debug threshold = 10
eventlog list =
add share command =
change share command =
delete share command =
preload =
lock directory = /var/run/samba
state directory = /var/lib/samba
cache directory = /var/cache/samba
pid directory = /var/run/samba
utmp directory =
wtmp directory =
utmp = No
default service =
message command =
get quota command =
set quota command =
remote announce =
remote browse sync =
socket address = 0.0.0.0
nmbd bind explicit broadcast = Yes
homedir map = auto.home
afs username map =
afs token lifetime = 604800
log nt token command =
time offset = 0
NIS homedir = No
registry shares = No
usershare allow guests = Yes
usershare max shares = 100
usershare owner only = Yes
usershare path = /var/lib/samba/usershares
usershare prefix allow list =
usershare prefix deny list =
usershare template share =
allow insecure wide links = No
async smb echo handler = No
multicast dns register = Yes
panic action = /usr/share/samba/panic-action %d
perfcount module =
host msdfs = Yes
passdb expand explicit = No
idmap backend = tdb
idmap cache time = 604800
idmap negative cache time = 120
idmap uid =
idmap gid =
template homedir = /home/%D/%U
template shell = /bin/false
winbind separator = \
winbind cache time = 300
winbind reconnect delay = 30
winbind max clients = 200
winbind enum users = No
winbind enum groups = No
winbind use default domain = No
winbind trusted domains only = No
winbind nested groups = Yes
winbind expand groups = 1
winbind nss info = template
winbind refresh tickets = No
winbind offline logon = No
winbind normalize names = No
winbind rpc only = No
create krb5 conf = Yes
ncalrpc dir = /var/ncalrpc
winbind max domain connections = 1
idmap config * : backend = tdb
comment =
path =
username =
invalid users =
valid users =
admin users =
read list =
write list =
printer admin =
force user =
force group =
read only = Yes
acl check permissions = Yes
acl group control = No
acl map full control = Yes
create mask = 0744
force create mode = 00
security mask = 0777
force security mode = 00
directory mask = 0755
force directory mode = 00
directory security mask = 0777
force directory security mode = 00
force unknown acl user = No
inherit permissions = No
inherit acls = No
inherit owner = No
guest only = No
administrative share = No
guest ok = No
only user = No
hosts allow =
hosts deny =
allocation roundup size = 1048576
aio read size = 0
aio write size = 0
aio write behind =
ea support = No
nt acl support = Yes
profile acls = No
map acl inherit = No
afs share = No
smb encrypt = auto
block size = 1024
change notify = Yes
directory name cache size = 100
kernel change notify = Yes
max connections = 0
min print space = 0
strict allocate = No
strict sync = No
sync always = No
use sendfile = No
write cache size = 0
max reported print jobs = 0
max print jobs = 1000
printable = No
print notify backchannel = Yes
print ok = No
printing = cups
cups options =
print command =
lpq command = %p
lprm command =
lppause command =
lpresume command =
queuepause command =
queueresume command =
printer name =
use client driver = No
default devmode = Yes
force printername = No
printjob username = %U
default case = lower
case sensitive = Auto
preserve case = Yes
short preserve case = Yes
mangling char = ~
hide dot files = Yes
hide special files = No
hide unreadable = No
hide unwriteable files = No
delete veto files = No
veto files =
hide files =
veto oplock files =
map archive = Yes
map hidden = No
map system = No
map readonly = yes
mangled names = Yes
store dos attributes = No
dmapi support = No
browseable = Yes
access based share enum = No
blocking locks = Yes
csc policy = manual
fake oplocks = No
locking = Yes
oplocks = Yes
level2 oplocks = Yes
oplock contention limit = 2
posix locking = Yes
strict locking = Auto
share modes = Yes
dfree cache time = 0
dfree command =
copy =
preexec =
preexec close = No
postexec =
root preexec =
root preexec close = No
root postexec =
available = Yes
volume =
fstype = NTFS
set directory = No
wide links = No
follow symlinks = Yes
dont descend =
magic script =
magic output =
delete readonly = No
dos filemode = No
dos filetimes = Yes
dos filetime resolution = No
fake directory create times = No
vfs objects =
msdfs root = No
msdfs proxy =
[homes]
comment = Home Directories
valid users = %S
create mask = 0700
directory mask = 0700
browseable = No
[printers]
comment = All Printers
path = /var/spool/samba
create mask = 0700
printable = Yes
print ok = Yes
browseable = No
[print$]
comment = Printer Drivers
path = /var/lib/samba/printers
[USBHD]
comment = Dysk udostepniony
path = /media/USBHD
valid users = @users
force group = users
read only = No
create mask = 0777
directory mask = 0777
guest ok = Yes
答案1
SLES 11.4 已经足够老了，其 Samba 仅默认为 SMBv1。您已经设置了client min protocol和client max protocol，这仅在 Samba 作为客户端时影响 Samba，例如smbclient。
对于服务器端，您只设置了server min protocol，因此server max protocol仍然默认为 SMBv1。而且因为现在 min 协议高于 max，smbd实际上根本不允许任何协议。
事实上，SLES 11.4 的 Samba 太旧了，而且它的 SMBv3 支持似乎有问题（正如您所发现的），这导致我们将所有仍在运行 SLES 11.4 的 Samba 服务器升级到 SLES 12 或更高版本作为工作的首要任务。
答案2
在具有内核 3.0 的 SLES 11.4 中运行 Samba-3.6.3，我的全局部分是这个，我知道 SMB2 可以工作，因为 Windows 10 客户端不会通过 SMB1 连接，对于开箱即用的 Win10，最低要求是 SMB2。
请注意，如果您设置了Min Protocol = SMB2，如果您的客户端是 Windows 7，它将不适用于它们...至少我没有弄清楚 Windows 端的故障排除我认为对于 Win7，它是默认的 SMB1，除非您在 win7 中手动配置某些内容说做SMB2。
无论出于何种原因设置max protocol = SMB3导致事情对我不起作用，因此我指定了 SMB2。
[global]
min protocol = SMB2
max protocol = SMB2
workgroup = workgroup
passdb backend = tdbsam
map to guest = Never
usershare allow guests = No
add machine script = /usr/sbin/useradd -c Machine -d /var/lib/nobody -s /bin/false %m$
domain master = No
security = user
wins support = No
server signing = auto
name resolve order = lmhosts bcast host
printing = bsd
printcap name = /dev/null
log level = 2 auth:10 auth_audit:3 auth_json_audit:3 winbind:5
max log size = 1000000
以及我使用的共享示例
[data1]
create mask = 660
directory mask = 770
inherit acls = Yes
path = /data1
read only = No
/etc/fstab除了像平常一样安装存储资源之外，您不需要做任何事情。然后，一旦安装，请确保该文件夹的访问权限...chmod 777 /data1在我的示例中，对初学者开放，然后在工作时继续删除世界权限并根据需要更改组所有权和权限。