Solved!
Go to SolutionN
Nori_Ishitsuka
Moderator
•
751 Posts
0
12501
May 15th, 2017 21:00
How can I disable SMBv1?
Hi all,
How Can I disable SMBv1?
Because I want to take measures for WannaCryptor.
Best Regards.
Rainer_EMC
6 Operator
•
8645 Posts
7366
1
Posted May 16th, 2017 05:00
Hi,
disabling SMBv1 on Unity / VNX / VNXe is NOT necessary.
On unpatched Windows systems WannaCry can use a Microsoft bug to infect them through a remote execution vulnerability in the Microsoft SMB code.
This is not present on Unity / VNX / VNXe since it does NOT run the Microsoft SMB stack.
Plus it doesnt run Windows OS so WannaCrypt wouldnt run there even if it could get there.
Please be careful though and do not disable SMB1 on the domain controller that the systems are using for authentication - for talking to the DC with SMBv2 you would need a hotfix on the Unity / VNX / VNXe
Nori_Ishitsuka
Moderator
•
751 Posts
7365
0
Posted May 17th, 2017 15:00
Rainer_EMC,
Thank you for your kindness information.
I can understand for technical background and disable procedure.
It's very important and interesting information, thank you again.
Best Regards.
Rainer_EMC
6 Operator
•
8645 Posts
7365
0
Posted May 17th, 2017 16:00
You could just as well disable SMB1 on the clients - Microsoft has instructions and PowerShell tools for that available
Especially since each client quickly becomes a server once you share a directory
Rainer_EMC
6 Operator
•
8645 Posts
7368
1
Posted May 17th, 2017 16:00
you're welcome
please keep in mind that its absolutely not necessary to disable SMB1 on VNX/Unity/VNXe because of WannaCry
If it makes you feel more secure you can do so - just keep in mind that this can lock out old clients
DELL_ChrisHolloway
2 Intern
•
125 Posts
7386
0
Posted May 22nd, 2017 04:00
A new KB article has been published today covering SMB1 and how to disable it
https://emcservice--c.na55.visual.force.com/apex/KB_How_To?id=kA5f1000000CdqY
For VNXe, the KB says you should contact EMC Support for assistance.
Nori_Ishitsuka
Moderator
•
751 Posts
7386
0
Posted May 22nd, 2017 04:00
Thank you for your kindness information.
And can I ask one more question?
I have some VNXe units, both VNXe1 and VNXe2.
How can I disable SMBv1 on that?
I've understood that is not necessary to disable on the Storage,but IT manager said that...
Regards.
Spencer Simpson
13 Posts
7386
0
Posted October 12th, 2017 06:00
Broken link; this just gives me the EMC support home page.
Rainer_EMC
6 Operator
•
8645 Posts
1617
0
Posted October 13th, 2017 00:00
the link works fine for me - you first have to have authenticated with support.emc.com
you can also get to it by entering the kb number (499999) or searching for SMB1 disable
Rainer_EMC
6 Operator
•
8645 Posts
7366
0
Posted May 17th, 2017 07:00
If you still want to disable SMB1 on the VNX - even though its not necessary - you can do that easily via a param change
For VNX and older products, from CS using the user nasadmin ssh session,
server_param ALL –f cifs –m smb1.disabled -v 1
For Unity 4.1.x, from the master SP using the user service user ssh session,
svc_param ALL –f cifs –m smb1.disabled -v 1
Just keep in mind that this will lock out all CIFS clients that only support SMB1 like Windows XP and older plus other devices like some network printers or scanners