SMB/CIFS: network file sharing with Samba

SMB (Server Message Block) is the network file and printer sharing protocol, born in the Windows world. A client mounts a remote shared folder and uses it like a local disk, on TCP port 445. On Linux, the open source implementation is called Samba. This guide explains the difference between SMB and CIFS, how to access a share with smbclient, audit a server with nmap, and harden a Samba configuration. For administrators and blue team profiles, on the command line.

What you will learn

• The difference between SMB, CIFS and Samba.
• The versions of SMB and why SMB1 is dangerous.
• Access a share with smbclient and mount it.
• Audit an SMB server with nmap.
• Harden a Samba configuration.

What are SMB and CIFS?

SMB is the protocol that lets machines share files and printers. Created by IBM in the 80s then extended by Microsoft, it is the mechanism behind corporate network drives and most NAS devices (Synology, TrueNAS, QNAP).

The term CIFS (Common Internet File System) is confusing. It is not a separate protocol: it is the name Microsoft gave in 1996 to a variant of SMB1.

Term	Reality
CIFS	old name of SMB1
SMB	the current protocol (SMB2, SMB3)
Samba	the open source implementation for Linux

Swipe to see more

Remember the simple rule: CIFS = SMB1, an obsolete dialect. When you mount a share with mount -t cifs, you are actually using a modern SMB client; the cifs name stayed for historical reasons.

SMB versions

Choosing the right version is first of all a matter of security. Three generations coexist, and the first one must disappear.

Version	Introduced	Key point
SMB1 (CIFS)	90s	obsolete, EternalBlue vector, to disable
SMB2	Windows Vista / Server 2008	signing available, no encryption
SMB3	Windows 8 / Server 2012	encryption available, to require on the server side
SMB 3.1.1	Windows 10 / Server 2016	AES-128-GCM encryption, pre-auth integrity

Swipe to see more

On the network side, two ports come into play: TCP 445 (SMB directly over TCP, the standard) and TCP 139 (historical SMB encapsulated in NetBIOS). In practice, you watch 445.

SMB1: EternalBlue, WannaCry, NotPetya

SMB1 is the protocol exploited by the EternalBlue (MS17-010) flaw, used by the WannaCry and NotPetya ransomware in 2017 (more than 200,000 systems hit). Microsoft disables it by default since Windows Server 2019. Disable it everywhere and enforce at least SMB2, ideally SMB3.

Samba: SMB on Linux

Samba is the open source implementation of the SMB protocol for Linux and Unix. It lets a Linux server share files with Windows, macOS and Linux clients, and can even act as an Active Directory domain controller. The current stable version is Samba 4.25, released on 24 September 2026 (read on download.samba.org).

Its configuration lives in /etc/samba/smb.conf: a [global] section for the general settings, then one block per share. A minimal share looks like this:

[partage]
    path = /srv/partage
    valid users = alice
    read only = no

Access a share from the command line

The reference client is smbclient (smbclient package on Debian/Ubuntu, samba-client on RHEL/Fedora). The outputs below come from a real lab: a Samba server in a container exposing a partage share.

1. List the shares of a server, after authentication:

   smbclient -L //serveur -U alice

   Sharename       Type      Comment
   partage         Disk
   IPC$            IPC       IPC Service (Samba Server)

2. Connect to a share: the session is interactive, like an FTP client (ls, get, put, cd):

   smbclient //serveur/partage -U alice

3. Mount the share as a file system with cifs-utils:

   sudo mount -t cifs //serveur/partage /mnt -o username=alice

   Do not force vers=3.0, contrary to what you read everywhere: automatic negotiation gives a higher dialect, and this guide also hardens the server in a way that makes vers=3.0 incompatible.

`vers=3.0` and `server min protocol = SMB3` cancel each other out

Here is a contradiction many tutorials spread, including earlier versions of this page: forcing vers=3.0 on the client and hardening the server with server min protocol = SMB3 produces a mount that fails.

mount error(95): Operation not supported
CIFS: VFS: \\serveur Dialect not supported by server.

The cause lies in a subtlety of vocabulary. In Samba, SMB3 is an alias of the most recent dialect of the family, SMB3_11, while vers=3.0 on the client asks precisely for SMB3_00, older. The server, which has just been forbidden everything below SMB3_11, therefore refuses the client's request.

And the security argument falls too. Measured on Ubuntu 24.04 with Samba 4.19.5, on the same hardened server:

Mount	Result
-o vers=3.0	failure, Operation not supported
no vers= option	success, dialect 3.1.1
-o vers=3.0 against a server at SMB3_00	success, dialect 3.0

Swipe to see more

Automatic negotiation obtains 3.1.1, a version higher than the one vers=3.0 asks for. Forcing the version therefore secures nothing here, it downgrades the dialect when it works, and breaks the mount when the server is hardened.

Good practice: harden the server with server min protocol = SMB3 and let the client negotiate. Only set vers= to talk to an old device that requires it, and know that you are then lowering the level.

Audit an SMB server

Before securing, you must see what an attacker sees. Two checks matter: the accepted versions and anonymous access.

nmap enumerates the supported SMB dialects. On the lab, the server accepts SMB 2.1 and 3.0, but not SMB1, which is the expected behaviour:

nmap -p445 --script smb-protocols serveur

445/tcp open  microsoft-ds
| smb-protocols:
|   dialects:
|     2.1
|     3.0

The second test is anonymous access (null session). On the lab, listing the shares without authentication succeeds, which reveals the share to anyone:

smbclient -L //serveur -N

Sharename       Type      Comment
partage         Disk

Null sessions expose your server

A null session (anonymous access) lets you enumerate shares, users and password policies without any credentials. It is a classic entry point for lateral movement in pentests. The nmap --script smb-enum-shares and enum4linux-ng tools automate this reconnaissance. Cut off null sessions (see below).

Harden a Samba configuration

SMB security rests on a few directives in the [global] section of smb.conf. The goal: refuse old protocols, encrypt, sign and block anonymous access.

[global]
    server min protocol = SMB3        # alias of SMB3_11: refuses SMB1, SMB2 and SMB3.0
    smb encrypt = required            # mandatory encryption (SMB3)
    server signing = mandatory        # enforced signing (anti NTLM relay)
    restrict anonymous = 2            # cuts off null sessions

Each line closes a concrete flaw:

• server min protocol = SMB3 rules out SMB1 (EternalBlue) and unencrypted SMB2;
• smb encrypt = required encrypts the exchanges (only effective with SMB3);
• server signing = mandatory against NTLM relay (SMB relay);
• restrict anonymous = 2 cuts off null sessions.

Complete with valid users on each share to restrict access, and above all: never expose port 445 on the Internet. SMB stays confined to the local network, behind a firewall.

Put it into practice

Mount an SMB/CIFS share in a persistent and safe way on a VM: credentials in a protected file, entry in /etc/fstab, and a check of the mount after reboot.

Guided lab Practice

Learn how to do it

Mount an SMB/CIFS share persistently and safely

$ dsoxlab run lfcs-mount-cifs

Environment: VM·Duration: ~30 min

How it is checked: the state of the system is checked after a reboot, not the command you typed.

First time? What DSOXLab is and how to install it

DSOXLab is the command line that prepares a disposable environment (an isolated shell or a VM), runs the lab scenario, then checks the real state of the system and computes a score. Nothing is installed or broken on your workstation.

It needs Python 3.11 or later, uv or pipx, and git. The installation guide details these prerequisites; on Windows, or on a Mac without Python, use the appliance instead.

This lab starts virtual machines: it also needs ansible-playbook, a hypervisor (KVM or Incus), Terraform and hardware virtualization (/dev/kvm), which inside a VirtualBox VM means nested virtualization. The first time, dsoxlab start lfcs-mount-cifs checks all of it before creating the machines. Prepare your machine for vm labs.

Install the CLI and add the catalogue, once:

uv tool install dsoxlab   # or: pipx install dsoxlab
dsoxlab catalog add https://github.com/stephrobert/linux-dsoxlab-training

Before you run the lab, check:

• DSOXLab installed
• catalogue available
• compatible environment (isolated shell or VM)

To check, nothing is probed from this page: run dsoxlab doctor. Read the diagnosis

Run this lab, then validate your work:

dsoxlab run lfcs-mount-cifs
dsoxlab check lfcs-mount-cifs

See every lab: dsoxlab list-labs. Track your progress: dsoxlab progress. The full dsoxlab guide covers scoring and the pitfalls.

Key points

• SMB is the network file sharing protocol; Samba is its open source Linux implementation.
• CIFS = SMB1, an obsolete dialect to disable (EternalBlue, WannaCry).
• The port to watch is TCP 445; 139 is historical (NetBIOS).
• On the CLI client side: smbclient -L lists, smbclient //srv/share connects, mount -t cifs mounts. Do not force vers=3.0: negotiation gives 3.1.1, and vers=3.0 breaks the mount on a server with server min protocol = SMB3.
• Audit with nmap --script smb-protocols and test anonymous access (null session).
• Harden Samba: server min protocol = SMB3, smb encrypt = required, restrict anonymous = 2.
• Never expose port 445 on the Internet.

Knowledge check

Check that the essentials of this guide are acquired. The questions only cover what has just been explained here.

Knowledge check

Check what you have learned with this interactive quiz

6 questions

6 min

70% to pass

How it works

• The timer starts when you click Start
• Multiple choice, true/false and short answer questions
• You can move between questions
• Detailed results are shown at the end

Start the quiz

Starts the quiz and the timer

FAQ: frequently asked questions about SMB/CIFS

These answers cover the most frequent questions about SMB: the difference with CIFS, port 445, the smbclient commands and the danger of SMB1.

What is the SMB protocol?

What is the difference between SMB and CIFS?

Which port does SMB use?

How do you list SMB shares from the command line?

Is SMB1 dangerous?

What is Samba?

×

See in the glossary →