Samba That Encrypts Every Session

samba-share

Samba as a file server for named accounts: SMB 3 only, every session encrypted and signed, no home-directory shares, no printer shares, no NetBIOS. Original role for EL 10, live-tested with podman on Rocky Linux 10.

The wire is open unless the client insists. In the package configuration server smb encrypt and server signing are both default, which for a standalone server means: encrypt or sign only when the client asks. Most do not ask. This role sets required and mandatory. The live test opens a session with encryption switched off in the client and reads from the server (smbstatus) that the session is SMB 3.1.1 with AES-GCM encryption and GMAC signing anyway - "required" means the client's wish does not matter.

SMB 2.0.2 is accepted. server min protocol = SMB2_02 admits the Vista era dialect, without encryption support. The role sets SMB3 and the live test connects as an SMB 2 client and expects a refusal.

Every local account's home is a share. The package smb.conf ships [homes] (writable) and [printers] / [print$] with load printers = yes. The role writes the whole file: only the shares you list, for the users you list, restrict anonymous = 2 so a stranger cannot even list them.

Port 445 only. NetBIOS name service, nmbd and port 139 are a 1990s discovery protocol on a file server; the role disables them and the live test reads the listening sockets.

Accounts are set through smbpasswd, not rendered. A password is set when the account is missing from Samba's database (or for all accounts with samba_share_reset_passwords), which keeps the second run at changed=0. The matching Unix account is created with no shell.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.