Jump to content

Server Message Block

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by 216.137.192.89 (talk) at 04:06, 13 July 2015 (→Security: Reworded things to remove opinionation and implication of a conspiracy theory). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

In computer networking, Server Message Block (SMB), one version of which was also known as Common Internet File System (CIFS, /ˈsɪfs/),[1][2] operates as an application-layer network protocol[3] mainly used for providing shared access to files, printers, and serial ports and miscellaneous communications between nodes on a network. It also provides an authenticated inter-process communication mechanism. Most usage of SMB involves computers running Microsoft Windows, where it was known as "Microsoft Windows Network" before the subsequent introduction of Active Directory. Corresponding Windows services are LAN Manager Server (for the server component) and LAN Manager Workstation (for the client component).[4]

Features

SMB can run on top of the Session (and lower) network layers in several ways:

The SMB "Inter-Process Communication" (IPC) system provides named pipes and was one of the first inter-process mechanisms commonly available to programmers that provides a means for services to inherit the authentication carried out when a client[clarification needed] first connected to an SMB server.[citation needed]

Some services that operate over named pipes, such as those which use Microsoft's own implementation of DCE/RPC over SMB, known as MSRPC over SMB, also allow MSRPC client programs to perform authentication, which over-rides the authorization provided by the SMB server, but only in the context of the MSRPC client program that successfully makes the additional authentication.

SMB signing: Windows NT 4.0 Service Pack 3 and upwards have the capability to use cryptography to digitally sign SMB connections. The most common official term is "SMB signing". Other terms that have been used officially are "[SMB] Security Signatures", "SMB sequence numbers"[7] and "SMB Message Signing".[8] SMB signing may be configured individually for incoming SMB connections (handled by the "LanManServer" service) and outgoing SMB connections (handled by the "LanManWorkstation" service). The default setting from Windows 98 and upwards is to opportunistically sign outgoing connections whenever the server also supports this. And to fall back to unsigned SMB if both partners allow this. The default setting for Windows domain controllers from Server 2003 and upwards is to not allow fall back for incoming connections.[9] The feature can also be turned on for any server running Windows NT 4.0 Service Pack 3 or later. This protects from man-in-the-middle attacks against the Clients retrieving their policies from domain controllers at login.[10]

The design of Server Message Block version 2 (SMB2) aims[citation needed] to mitigate this performance-limitation by coalescing SMB signals into single packets.

SMB supports opportunistic locking — a special type of locking-mechanism — on files in order to improve performance.

SMB serves as the basis for Microsoft's Distributed File System implementation.

History

Barry Feigenbaum originally designed SMB at IBM with the aim of turning DOS "Interrupt 33" (21h) local file access into a networked file system. Microsoft has made considerable modifications to the most commonly used version. Microsoft merged the SMB protocol with the LAN Manager product which it had started developing for OS/2 with 3Com around 1990, and continued to add features to the protocol in Windows for Workgroups (c. 1992) and in later versions of Windows.

SMB was originally designed to run on top of the NetBIOS/NetBEUI API (typically implemented with NBF, NetBIOS over IPX/SPX, or NBT). Since Windows 2000, SMB runs, by default, with a thin layer, similar to the Session Message packet of NBT's Session Service, on top of TCP, using TCP port 445 rather than TCP port 139—a feature known as "direct host SMB".[5]

At around the time when Sun Microsystems announced WebNFS,[11] Microsoft launched an initiative in 1996 to rename SMB to Common Internet File System (CIFS), and added more features, including support for symbolic links, hard links, larger file sizes, and an initial attempt at supporting direct connections over TCP port 445 without requiring NetBIOS as a transport (a largely experimental effort that required further refinement). Microsoft submitted some partial specifications as Internet-Drafts to the IETF,[12] though these submissions have expired.

The Samba project originated with the aim of reverse engineering the SMB protocol and implementing an SMB server to allow MS-DOS clients to use SMB to access files on Sun Microsystems machines.[13] Because of the importance of the SMB protocol in interacting with the widespread Microsoft Windows platform, Samba became a popular free software implementation of a compatible SMB client and server to allow non-Windows operating systems, such as Unix-like operating systems, to interoperate with Windows.

Visuality Systems has developed a multi-platform SMB implementation available for embedded devices.

Microsoft introduced SMB2 with Windows Vista in 2006, and later improved on it in Windows 7, with subsequent major revisions of 2.1 and 3.0 as of 2012.

SMB 2.0

Microsoft introduced a new version of the protocol (SMB 2.0 or SMB2) with Windows Vista in 2006.[14] Although the protocol is proprietary, its specification has been published to allow other systems to interoperate with Microsoft operating systems that use the new protocol.[15]

SMB2 reduces the 'chattiness' of the SMB 1.0 protocol by reducing the number of commands and subcommands from over a hundred to just nineteen.[16] It has mechanisms for pipelining, that is, sending additional requests before the response to a previous request arrives, thereby improving performance over high latency links. It adds the ability to compound multiple actions into a single request, which significantly reduces the number of round-trips the client needs to make to the server, improving performance as a result.[16] SMB1 also has a compounding mechanism — known as AndX — to compound multiple actions, but Microsoft clients rarely use AndX.[citation needed] It also introduces the notion of "durable file handles": these allow a connection to an SMB server to survive brief network outages, as are typical in a wireless network, without having to incur the overhead of re-negotiating a new session.

SMB2 includes support for symbolic links. Other improvements include caching of file properties, improved message signing with HMAC SHA-256 hashing algorithm and better scalability by increasing the number of users, shares and open files per server among others.[16] The SMB1 protocol uses 16-bit data sizes, which amongst other things, limits the maximum block size to 64K. SMB2 uses 32 or 64-bit wide storage fields, and 128 bits in the case of file-handles, thereby removing previous constraints on block sizes, which improves performance with large file transfers over fast networks.[16]

Windows Vista/Server 2008 and later operating systems use SMB2 when communicating with other machines also capable of using SMB2. SMB1 continues in use for connections with older versions of Windows, as well as systems like Samba and various vendors' NAS solutions. Samba 3.5 also includes experimental support for SMB2.[17] Samba 3.6 fully supports SMB2, except the modification of user quotas using the Windows quota management tools.[18]

When SMB2 was introduced it brought a number of benefits over SMB1 for third party implementers of SMB protocols. SMB1, originally designed by IBM, was reverse engineered, and later became part of a wide variety of non-Windows operating systems such as Xenix, OS/2 and VMS (Pathworks). X/Open standardised it partially; it also had draft IETF standards which lapsed. (See http://ubiqx.org/cifs/Intro.html for historical detail.) SMB2 is also a relatively clean break with the past. Microsoft's SMB1 code has to work with a large variety of SMB clients and servers. SMB1 features many versions of information for commands (selecting what structure to return for a particular request) because features such as Unicode support were retro-fitted at a later date. SMB2 involves significantly reduced compatibility-testing for implementers of the protocol. SMB2 code has considerably less complexity since far less variability exists (for example, non-Unicode code paths become redundant as SMB2 requires Unicode support).

Apple is also migrating to SMB2 (from their own Apple Filing Protocol, now legacy) with OS X 10.9.[19] This transition was fraught with compatibility problems though.[20][21] Non-default support for SMB2 appeared in fact in OS X 10.7, when Apple abandoned Samba in favor of its own SMB implementation called SMBX.[19] Apple switched to its own SMBX implementation after Samba adopted GPLv3.[22][23]

SMB 2.1

SMB 2.1, introduced with Windows 7 and Server 2008 R2, introduced minor performance enhancements with a new opportunistic locking mechanism.[24]

SMB 3.0

SMB 3.0 (previously named SMB 2.2)[25] was introduced with Windows 8[25] and Windows Server 2012.[25] It brought several significant changes, such as the SMB Direct Protocol (SMB over RDMA) and SMB Multichannel (multiple connections per SMB session),[26][27] that are intended to add functionality and improve SMB2 performance,[28] notably in virtualized data centers.

It also introduces several security enhancements, such as end-to-end encryption and a new AES based signing algorithm.[29]

SMB 3.02

SMB 3.02 has been introduced with Windows 8.1 and Windows Server 2012 R2.[30][31] In 3.02 the earlier SMB version 1 can be optionally disabled to increase security.[32]

Implementation

Client-server approach

SMB works through a client-server approach, where a client makes specific requests and the server responds accordingly. One section of the SMB protocol specifically deals with access to filesystems, such that clients may make requests to a file server; but some other sections of the SMB protocol specialize in inter-process communication (IPC). The Inter-Process Communication (IPC) share, or ipc$, is a network share on computers running Microsoft Windows. This virtual share is used to facilitate communication between processes and computers over SMB, often to exchange data between computers that have been authenticated.

Developers have optimized the SMB protocol for local subnet usage, but users have also put SMB to work to access different subnets across the Internet—exploits involving file-sharing or print-sharing in MS Windows environments usually focus on such usage.

SMB servers make their file systems and other resources available to clients on the network. Client computers may want access to the shared file systems and printers on the server, and in this primary functionality SMB has become best-known and most heavily used. However, the SMB file-server aspect would count for little without the NT domains suite of protocols, which provide NT-style domain-based authentication at the very least. Almost all implementations of SMB servers use NT Domain authentication to validate user-access to resources.

Samba

Main article: Samba (software)

Andrew Tridgell started the development of Samba, a free-software re-implementation of the SMB/CIFS networking protocol for Unix-like systems, in 1991. As of version 3 (2003), Samba provides file and print services for Microsoft Windows clients and can integrate with a Windows NT 4.0 server domain, either as a Primary Domain Controller (PDC) or as a domain member. Samba4 installations can act as an Active Directory domain controller or member server, at Windows 2008 domain and forest functional levels.[33]

Note in relation to Samba the use of the Linux cifs-utils package.[34]

Performance issues

The use of the SMB protocol has often correlated with a significant increase in broadcast traffic on a network. However the SMB itself does not use broadcasts—the broadcast problems commonly associated with SMB actually originate with the NetBIOS service location protocol.[clarification needed] By default, a Microsoft Windows NT 4.0 server used NetBIOS to advertise and locate services. NetBIOS functions by broadcasting services available on a particular host at regular intervals. While this usually makes for an acceptable default in a network with a smaller number of hosts, increased broadcast traffic can cause problems as the number of hosts on the network increases. The implementation of name resolution infrastructure in the form of Windows Internet Naming Service (WINS) or Domain Name System (DNS) resolves this problem. WINS was a proprietary implementation used with Windows NT 4.0 networks, but brought about its own issues and complexities in the design and maintenance of a Microsoft network.

Since the release of Windows 2000, the use of WINS for name resolution has been deprecated by Microsoft, with hierarchical Dynamic DNS now configured as the default name resolution protocol for all Windows operating systems. Resolution of (short) NETBIOS names by DNS requires that a DNS client expand short names, usually by appending a connection-specific DNS suffix to its DNS lookup queries. WINS can still be configured on clients as a secondary name resolution protocol for interoperability with legacy Windows environments and applications. Further, Microsoft DNS servers can forward name resolution requests to legacy WINS servers in order to support name resolution integration with legacy (pre-Windows 2000) environments that do not support DNS.

Network designers have found that latency has a significant impact on the performance of the SMB 1.0 protocol, that it performs more poorly than other protocols like FTP. Monitoring reveals a high degree of "chattiness" and a disregard of network latency between hosts.[16] For example, a VPN connection over the Internet will often introduce network latency. Microsoft has explained that performance issues come about primarily because SMB 1.0 is a block-level rather than a streaming protocol, that was originally designed for small LANs; it has a block size that is limited to 64K, SMB signing creates an additional overhead and the TCP window size is not optimized for WAN links.[35] Solutions to this problem include the updated SMB 2.0 protocol, Offline Files, TCP window scaling and WAN acceleration devices from various network vendors that cache and optimize SMB 1.0[36] and 2.0.[37]

Microsoft's modifications

Microsoft added several extensions to its own SMB implementation. For example, it added NTLM, then NTLMv2 authentication protocols in order to address security weakness in the original LAN Manager authentication. LAN Manager authentication was implemented based on the original legacy SMB specification's requirement to use IBM "LAN Manager" passwords, but implemented DES in a flawed manner that allowed passwords to be cracked.[38] Later, Kerberos authentication was also added. The NT 4.0 Domain logon protocols initially used 40-bit encryption outside of the United States of America, because of export restrictions on stronger 128-bit encryption[39] (subsequently lifted in 1996 when President Bill Clinton signed Executive Order 13026[40]). Opportunistic locking support has changed with each server release.

In the SMB protocol, opportunistic locking is a file locking mechanism designed to improve performance by controlling caching of network files by the client.[41] Contrary to the traditional locks, OpLocks are not used to provide mutual exclusion. The main goal of OpLocks is to provide synchronization for caching. There are three types of opportunistic locks:

Batch Locks
Batch OpLocks were created originally to support a particular behavior of MS-DOS batch file execution operation in which the file is opened and closed many times in a short period, which is a performance problem. To solve this, a client may ask for an OpLock of type "batch". In this case, the client delays sending the close request and if a subsequent open request is given, the two requests cancel each other.[42]
Exclusive Locks
When an application opens in "shared mode" a file hosted on an SMB server which is not opened by any other process (or other clients) the client receives an exclusive OpLock from the server. This means that the client may now assume that it is the only process with access to this particular file, and the client may now cache all changes to the file before committing it to the server. This is a performance improvement, since fewer round-trips are required in order to read and write to the file. If another client/process tries to open the same file, the server sends a message to the client (called a break or revocation) which invalidates the exclusive lock previously given to the client. The client then flushes all changes to the file.
Level 2 OpLocks
If an exclusive OpLock is held by a client and a locked file is opened by a third party, the client has to relinquish its exclusive OpLock to allow the other client's write/read access. A client may then receive a "Level 2 OpLock" from the server. A Level 2 OpLock allows the caching of read requests, but excludes write caching.
Breaks
In contrast with the SMB protocol's "standard" behavior, a break request may be sent from server to client. It informs the client that an OpLock is no longer valid. This happens, for example, when another client wishes to open a file in a way that invalidates the OpLock. The first client is then sent an OpLock break and required to send all its local changes (in case of batch or exclusive OpLocks), if any, and acknowledge the OpLock break. Upon this acknowledgment the server can reply to the second client in a consistent manner.

Security

Over the years, there have been many security vulnerabilities in Microsoft's implementation of the protocol or components on which it directly relies.[43][44] Other vendors' security vulnerabilities lie primarily in a lack of support for newer authentication protocols like NTLMv2 and Kerberos in favor of protocols like NTLMv1, LanMan, or plaintext passwords. Real-time attack tracking[45] shows that SMB is one of the primary attack vectors for intrusion attempts,[46] for example the 2014 Sony Pictures attack.[47]

Specifications

The specifications for the SMB are proprietary and were originally closed, thereby forcing other vendors and projects to reverse-engineer the protocol in order to interoperate with it. The SMB 1.0 protocol was eventually published some time after it was reverse engineered, whereas the SMB 2.0 procotol was made available from Microsoft's MSDN Open Specifications Developer Center from the outset.[48] There are a number of specifications that are relevant to the SMB protocol:

  • MS-CIFS [3] MS-CIFS is a recent replacement (2007) for the draft-leach-cifs-v1-spec-02.txt a document widely used to implement SMB clients, but also known to have errors of omission and commission.[citation needed]
  • MS-SMB [4] Specification for Microsoft Extensions to MS-CIFS
  • MS-SMB2 [5] Specification for the SMB 2 and SMB 3 protocols
  • MS-FSSO [6] Describes the intended functionality of the Windows File Access Services System, how it interacts with systems and applications that need file services, and how it interacts with administrative clients to configure and manage the system.
  • MS-SMBD [7] SMB2 Remote Direct Memory Access (RDMA) Transport Protocol Specification

See also

References

  1. ^ "Common Internet File System". Microsoft TechNet Library. Retrieved 2013-08-20. The Common Internet File System (CIFS) is the standard way that computer users share files across corporate intranets and the Internet. An enhanced version of the Microsoft open, cross-platform Server Message Block (SMB) protocol, CIFS is a native file-sharing protocol in Windows 2000.
  2. ^ "Microsoft SMB Protocol and CIFS Protocol Overview". Microsoft MSDN Library. 2013-07-25. Retrieved 2013-08-20. The Server Message Block (SMB) Protocol is a network file sharing protocol, and as implemented in Microsoft Windows is known as Microsoft SMB Protocol. The set of message packets that defines a particular version of the protocol is called a dialect. The Common Internet File System (CIFS) Protocol is a dialect of SMB. Both SMB and CIFS are also available on VMS, several versions of Unix and other operating systems.
  3. ^ "Microsoft SMB Protocol and CIFS Protocol Overview". Microsoft. 2009-10-22. Retrieved 2009-11-01.
  4. ^ "Lan Manager Networking Concepts". Microsoft.
  5. ^ a b "Direct hosting of SMB over TCP/IP". Microsoft. 2007-10-11. Retrieved 2009-11-01.
  6. ^ Richard Sharpe (8 October 2002). "Just what is SMB?". Retrieved 18 July 2011.
  7. ^ "MSKB887429: Overview of Server Message Block signing". Microsoft Corporation. 2007-11-30. Retrieved 2012-10-24. Security Signatures (SMB sequence numbers)
  8. ^ Jesper M. Johansson (2005-09-08). "How to Shoot Yourself in the Foot with Security, Part 1". Microsoft Corporation. Retrieved 2012-10-24. This article addresses [...] Server Message Block (SMB) message signing.
  9. ^ "MSKB887429: Overview of Server Message Block signing". Microsoft Corporation. 2007-11-30. Retrieved 2012-10-24. By default, SMB signing is required for incoming SMB sessions on Windows Server 2003-based domain controllers.
  10. ^ Jose Barreto (2010-12-01). "The Basics of SMB Signing (covering both SMB1 and SMB2)". Microsoft TechNet Server & Management Blogs. Retrieved 2012-10-24. This security mechanism in the SMB protocol helps avoid issues like tampering of packets and "man in the middle" attacks. [...] SMB signing is available in all currently supported versions of Windows, but it's only enabled by default on Domain Controllers. This is recommended for Domain Controllers because SMB is the protocol used by clients to download Group Policy information. SMB signing provides a way to ensure that the client is receiving genuine Group Policy.
  11. ^ YANFS yet another nfs
  12. ^ * Common Internet File System Protocol (CIFS/1.0)
  13. ^ Tridgell, Andrew (June 27, 1997). "A bit of history and a bit of fun". Retrieved 2011-07-26.
  14. ^ Navjot Virk and Prashanth Prahalad (March 10, 2006). "What's new in SMB in Windows Vista". Chk Your Dsks. MSDN. Retrieved 2006-05-01.
  15. ^ "(MS-SMB2): Server Message Block (SMB) Version 2 Protocol Specification". Microsoft. 2009-09-25. Retrieved 2009-11-01.
  16. ^ a b c d e Jose Barreto (2008-12-09). "SMB2, a Complete Redesign of the Main Remote File Protocol for Windows". Microsoft TechNet Server & Management Blogs. Retrieved 2009-11-01.
  17. ^ Samba 3.5 - Release Notes Archive
  18. ^ Samba 3.6 - Release Notes Archive
  19. ^ a b Eran, Daniel (2013-06-11). "Apple shifts from AFP file sharing to SMB2 in OS X 10.9 Mavericks". Appleinsider.com. Retrieved 2014-01-12.
  20. ^ Vaughan, Steven J. (2013-10-28). "Mavericks' SMB2 problem and fixes". ZDNet. Retrieved 2014-01-12.
  21. ^ MacParc. "10.9: Switch the SMB stack to use SMB1 as default - Mac OS X Hints". Hints.macworld.com. Retrieved 2014-01-12.
  22. ^ Say adios to Samba in OS X. Apple will apparently not be including Samba Windows networking technology in future versions of OS X because of Samba's upgrade to the GPLv3 license.
  23. ^ http://www.osnews.com/story/24572/Apple_Ditches_SAMBA_in_Favour_of_Homegrown_Replacement
  24. ^ "Implementing an End-User Data Centralization Solution". Microsoft. 2009-10-21. pp. 10–11. Retrieved 2009-11-02.
  25. ^ a b c Jeffrey Snover (19 April 2012). "Windows Server Blog: SMB 2.2 is now SMB 3.0". Microsoft. Retrieved 14 June 2012.
  26. ^ Jose Barreto (19 October 2012). "SNIA Tutorial on the SMB Protocol" (PDF). Storage Networking Industry Association. Retrieved 28 November 2012.
  27. ^ Thomas Pfenning. "The Future of File Protocols - SMB 2.2 in the Datacenter" (PDF).
  28. ^ Chelsio Communications. "40G SMB Direct".
  29. ^ "SMB Security Enhancements". Microsoft Technet. 15 January 2014. Retrieved 18 June 2014.
  30. ^ https://blogs.technet.com/b/josebda/archive/2014/01/24/updated-links-on-windows-server-2012-r2-file-server-and-smb-3-0.aspx
  31. ^ http://blogs.technet.com/b/josebda/archive/2013/12/12/storage-developer-conference-sdc-2013-slides-now-publicly-available-here-are-the-links-to-microsoft-slides.aspx
  32. ^ WindowsNetworking.com: Improvements in the SMB 3.0 and 3.02 Protocol Updates
  33. ^ "Samba - samba-technical - Samba 4 functional levels". Samba.2283325.n4.nabble.com. 2011-02-25. Retrieved 2014-01-12.
  34. ^ Fedora Documentation Project (2011). Fedora 15 Deployment Guide. Fultus Corporation. p. 321. ISBN 9781596822320. Retrieved 2013-05-07.
  35. ^ Neil Carpenter (2004-10-26). "SMB/CIFS Performance Over WAN Links". Microsoft. Retrieved 2009-11-01.
  36. ^ Mark Rabinovich, Igor Gokhman. "CIFS Acceleration Techniques" (PDF). Storage Developer Conference, SNIA, Santa Clara 2009.
  37. ^ Mark Rabinovich. "Accelerating SMB2" (PDF). Storage Developer Conference, SNIA, Santa Clara 2011.
  38. ^ Christopher Hertel (1999). "SMB: The Server Message Block Protocol". Retrieved 2009-11-01.
  39. ^ "Description of Microsoft Windows Encryption Pack 1". Microsoft. 2006-11-01. Retrieved 2009-11-01.
  40. ^ "US Executive Order 13026" (PDF). United States Government. 1996. Retrieved 2009-11-01.
  41. ^ "Opportunistic Locks". Microsoft. Retrieved 6 November 2012.
  42. ^ Sphere, I.T. (2014), All About Opportunistic Locking, retrieved 2014-04-09
  43. ^ "MS02-070: Flaw in SMB Signing May Permit Group Policy to Be Modified". Microsoft. 2007-12-01. Retrieved 2009-11-01.
  44. ^ "MS09-001: Vulnerabilities in SMB could allow remote code execution". Microsoft. 2009-01-13. Retrieved 2009-11-01.,
  45. ^ "Sicherheitstacho.eu". Deutsche Telekom. 2013-03-07. Retrieved 2013-03-07.
  46. ^ "Alert (TA14-353A) Targeted Destructive Malware". US-CERT.
  47. ^ "Sony Hackers Used Server Message Block (SMB) Worm Tool".
  48. ^ Windows Protocols
Retrieved from "https://en.wikipedia.org/w/index.php?title=Server_Message_Block&oldid=671201393"