☰

Linux SMB 客户端无法连接到 SMB 服务器强制使用 AES-256？

tag-icon • tag-icon fedora encryption smb smbclient
Linux SMB 客户端无法连接到 SMB 服务器强制使用 AES-256？

我正在尝试从 Fedora 连接到 TrueNAS 上的 SMB 共享。它运行良好，直到我决定启用 SMB 数据加密。我将以下内容放入 TrueNAS 的服务配置中（全局设置）

unix extensions = yes
server signing = required
client smb encrypt = required
server smb3 encryption algorithms = -AES-128-GCM -AES-128-CCM

以及特定 SMB 共享中的以下内容（每个共享设置）

server smb encrypt = required

然后，我尝试通过以下方式挂载 SMB 共享

sudo mount -t smb3 -o cred=<my_cred_file>,uid=1000,gid=1000,mfsymlinks //<TrueNAS IP>/NAS /mnt/NAS

并且，繁荣，mount error(13): Permission denied。

在 中dmesg，它说

[112496.066462] CIFS: Attempting to mount //<TrueNAS IP>/NAS
[112496.085283] CIFS: VFS: sign fail cmd 0x3 message id 0x3
[112496.085287] CIFS: VFS: \\<TrueNAS IP> SMB signature verification returned error = -13
[112496.085290] CIFS: VFS: \\<TrueNAS IP> failed to connect to IPC (rc=-13)
[112496.085294] CIFS: VFS: session 00000000639775cf has no tcon available for a dfs referral request
[112496.085480] CIFS: VFS: sign fail cmd 0x3 message id 0x4
[112496.085481] CIFS: VFS: \\<TrueNAS IP> SMB signature verification returned error = -13
[112496.085684] CIFS: VFS: sign fail cmd 0x2 message id 0x5
[112496.085687] CIFS: VFS: \\<TrueNAS IP> SMB signature verification returned error = -13
[112496.085690] CIFS: VFS: \\<TrueNAS IP> __cifs_put_smb_ses: Session Logoff failure rc=-13
[112496.085700] CIFS: VFS: cifs_mount failed w/return code = -13

如果我删除强制 AES-256 的行（不允许 AES-128）：

server smb3 encryption algorithms = -AES-128-GCM -AES-128-CCM

该mount命令会正常工作。

但是，即使我保留强制 AES-256 配置，我仍然可以从 macOS 和 iOS 上的 Finder 以及 KDE 上的 Dolphin 连接到我的 SMB 共享（我在 KDE 中使用 fedora）。

那么，smbclientcli 中是否根本不支持 AES-256 加密呢？或者我可以打开一些东西并使安装座完全正常工作吗？

顺便说一句，smbclient --version给出Version 4.19.4.

mount更新：以下是评论建议的详细输出。

$ sudo mount -t smb3 --verbose -o cred=<my_cred_file>,uid=1000,gid=1000,mfsymlinks //<TrueNAS IP>/NAS /mnt/NAS
mount.smb3 kernel mount options: ip=<TrueNAS IP>,unc=\\<TrueNAS IP>\NAS,mfsymlinks,uid=1000,gid=1000,user=<My Username>,pass=********
mount error(13): Permission denied
Refer to the mount.smb3(8) manual page (e.g. man mount.smb3) and kernel log messages (dmesg)

更新：尝试了不同的sec选项：

  • krb5/ krb5i：
    • mount详细输出： 
      $ sudo mount -t smb3 --verbose -o cred=<my_cred_file>,uid=1000,gid=1000,mfsymlinks,sec=<krb5/krb5i> //<TrueNAS IP>/NAS /mnt/NAS
mount.smb3 kernel mount options: ip=<TrueNAS IP>,unc=\\<TrueNAS IP>\NAS,mfsymlinks,sec=<krb5/krb5i>,uid=1000,gid=1000,user=<My Username>,pass=********
mount.smb3 kernel mount options: ip=<TrueNAS IP>,unc=\\<TrueNAS IP>\NAS,mfsymlinks,sec=<krb5/krb5i>,uid=1000,cruid=1000,gid=1000,user=<My Username>,pass=********
mount error(126): Required key not available
Refer to the mount.smb3(8) manual page (e.g. man mount.smb3) and kernel log messages (dmesg)
    • dmesg输出： 
      [190212.841620] CIFS: Attempting to mount //<TrueNAS IP>/NAS
[190212.851741] CIFS: VFS: unknown or missing server auth type, use krb5
[190212.861466] CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed
[190212.861472] CIFS: VFS: \\<TrueNAS IP> Send error in SessSetup = -126
[190212.861487] CIFS: VFS: cifs_mount failed w/return code = -126
  • ntlm/ntlmi:
    • mount详细输出： 
      $ sudo mount -t smb3 --verbose -o cred=<my_cred_file>,uid=1000,gid=1000,mfsymlinks,sec=<ntlm/ntlmi> //<TrueNAS IP>/NAS /mnt/NAS
mount.smb3 kernel mount options: ip=<TrueNAS IP>,unc=\\<TrueNAS IP>\NAS,mfsymlinks,sec=ntlm,uid=1000,gid=1000,user=<My Username>,pass=********
mount error(22): Invalid argument
Refer to the mount.smb3(8) manual page (e.g. man mount.smb3) and kernel log messages (dmesg)
    • dmesg输出： 
      [190683.752148] bad security option: <ntlm/ntlmi>

[190683.752170] CIFS: VFS: bad security option: <ntlm/ntlmi>
  • ntlmv2// ntlmv2i/ ntlmssp：ntlmsspi这四个选项在mount详细输出中没有任何区别，或者dmesg与不指定任何sec选项相比没有区别。

更新：尝试cifs指定vers选项：

  • vers=2.0:
    • mount输出： 
      mount.cifs kernel mount options: ip=<TrueNAS IP>,unc=\\<TrueNAS IP>\NAS,mfsymlinks,vers=2.0,uid=1000,gid=1000,user=<My Username>,pass=********
mount error(13): Permission denied
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg)
    • dmesg: 
      [281141.068174] CIFS: Attempting to mount //<TrueNAS IP>/NAS
[281141.085261] CIFS: VFS: \\<TrueNAS IP> smb2_calc_signature: Could not find session
[281141.085286] CIFS: VFS: \\<TrueNAS IP> __cifs_put_smb_ses: Session Logoff failure rc=-2
[281141.085298] CIFS: VFS: cifs_mount failed w/return code = -13
  • vers=1.0:

    • mount输出：

      mount.cifs kernel mount options: ip=<TrueNAS IP>,unc=\\<TrueNAS IP>\NAS,mfsymlinks,vers=1.0,uid=1000,gid=1000,user=<My Username>,pass=********
mount error(95): Operation not supported
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg)

      我删除了mfsymlinks（SMB1.0不支持？）但输出是一样的。

    • demsg:

      [281295.220579] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers

[281295.220601] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers
[281295.220609] CIFS: Attempting to mount //<TrueNAS IP>/NAS
[281295.231815] CIFS: VFS: cifs_mount failed w/return code = -95

相关内容