Skip to main content
Solved

So 10.9's SMB2 is buggy ...

  • October 29, 2013
  • 18 replies
  • 65 views
F
Forum|alt.badge.img+23

Encountered an interesting one during our pre-release testing: SMB2 to some of our server shares doesn't work properly. Mounted a known working share on 10.8 and it works there. Try the same thing again on 10.9 and it can't navigate or see folders down from the root folder.

However if you force 10.9 to mount the drive by using cifs://server.address/ which gets 10.9 to mount the share as SMB1 it works!

The only way round this that i've found is the following code:

# Create nsmb.conf file temporarily and tell it to force SMB1 use.

echo "[default]" >> ~/Library/Preferences/nsmb.conf
echo "smb_neg=smb1_only" >> ~/Library/Preferences/nsmb.conf

The catch is i've only made this work on a per user basis, rather than over the entire computer. Hopefully this will help anyone else having issues.

Best answer by franton

D'oh! I should have written the same file to /etc/nsmb.conf instead ...

    18 replies

    F
    Forum|alt.badge.img+23
    • franton
    • Author
    • Esteemed Contributor
    • Answer
    • October 29, 2013

    D'oh! I should have written the same file to /etc/nsmb.conf instead ...

    A
    Forum|alt.badge.img+4
    • ArielN
    • Contributor
    • October 29, 2013

    Hi Franton,

    We are faced with the same problem.What is the steps in getting this code added to run automatically?

    Thanks

    F
    Forum|alt.badge.img+23
    • franton
    • Author
    • Esteemed Contributor
    • October 29, 2013

    Make a policy, go to the advanced tab, add the following to the Run Command:

    echo "[default]" >> /etc/nsmb.conf ; echo "smb_neg=smb1_only" >> /etc/nsmb.conf
    F
    Forum|alt.badge.img+23
    • franton
    • Author
    • Esteemed Contributor
    • October 29, 2013

    Actually that just failed for me. I'm going to try scripting it instead.

    S
    Forum|alt.badge.img+13
    • Stubakka
    • Valued Contributor
    • October 29, 2013

    double post!

    S
    Forum|alt.badge.img+13
    • Stubakka
    • Valued Contributor
    • October 29, 2013

    Thank you i will keep an eye out for this, more info here http://www.zdnet.com/mavericks-smb2-problem-and-fixes-7000022519/

    H
    Forum|alt.badge.img+8
    • haircut
    • Contributor
    • October 29, 2013

    It's more than "buggy" – in certain environments Mavericks machines bound to AD can wipe out file/folder permissions or even delete files by changing permissions.

    See https://groups.google.com/forum/#!topic/macenterprise/B0R5-WTGIrM for some more info.

    We have shares on a NetApp and I've reproduced the problem on AD-bound Mavericks boxes. Clicking any "custom" permission in the Get Info window will wipe out the server-side permissions.

    N
    Forum|alt.badge.img+18
    • nessts
    • Valued Contributor
    • October 29, 2013

    definitely seeing permission problems on 10.9 with my linux server, I cannot turn off execute bit on the group setting to save my life on the Mac, go to the linux box and i can turn it off. sometimes my vi sessions hang on the smb share too. of course i had to type this reply in Safari because Firefox cannot scroll down most of the time so smb is just one of many problems.

    T
    Forum|alt.badge.img+21
    • tkimpton
    • Honored Contributor
    • October 29, 2013

    or simply connect cifs:// instead of smb://

    T
    Forum|alt.badge.img+21
    • tkimpton
    • Honored Contributor
    • October 29, 2013

    Apple worked with Microsoft to implment cifs (aka smb2)

    Because ive used Thursbys ADmitMac in the past, mount shares as cifs:// i didnt notice the problem.

    My guess is that Apple will just come out with a kb soon telling people thats how to connect now rather than messing with the OS.

    F
    Forum|alt.badge.img+23
    • franton
    • Author
    • Esteemed Contributor
    • October 29, 2013

    Not an option from the command line.

    Apple needs to not only FTFF but FTF networking.

    T
    Forum|alt.badge.img+21
    • tkimpton
    • Honored Contributor
    • October 30, 2013

    Yep no command line option for cifs welcome to my world ;) only way at the moment is to mount via Applescript

    F
    Forum|alt.badge.img+23
    • franton
    • Author
    • Esteemed Contributor
    • October 30, 2013

    Or if you need SMB2, you generate that nsmb.conf file on the fly, do what you gotta do and then delete the file. Either way … YUCK.

    M
    Forum|alt.badge.img+8
    • michaelhusar
    • Valued Contributor
    • December 19, 2013

    May I ask a little question on the side ? Sorry for that, but you all seem to use SMB for Fileservices and are the Pros for that topic.
    We use Windows2012R2 as Fileserver and I encounter a misinterpretation of ACL Permissions when copying files to the SMB Share. Especially the Userhome ACL "everyone deny delete" becomes strange on Windows. I get a unknown User-Account/Mode S-1-5-88-3-16832 or S-1-5-88-3-422 or S-1-5-88-3-xxx with a Deny rule. I tried to change access rights like suggested in http://serverfault.com/questions/498171/osx-10-8-3-creating-editing-files-on-windows-7-share-creates-weird-blocking-acco without success.
    Sometimes (not always- I love IT) these weird permissions block access to the files and nothing is working properly.
    I am coming to the point: Do you have a simple solution or do you use ExtremeZ-IP or AdmitMac or do you go with Helios or Synology Hardware?

    R
    Forum|alt.badge.img+18
    • rcorbin
    • Valued Contributor
    • August 24, 2015

    Does everyone still see these SMB2 issues in 10.10.x ? Or was it fixed there ?

    Also @michaelhusar we too have also seen that unknown account s-1-5-88-3-16832 with a deny. No idea what that is about.

    R
    Forum|alt.badge.img+18
    • rcorbin
    • Valued Contributor
    • August 28, 2015

    There is another thread that very much relates to this one.

    https://jamfnation.jamfsoftware.com/discussion.html?id=11266

    @jake.snyder Posted the solution below to force the connection to SMB1. I've tried it on individual machines via terminal and it works great. I haven't tried putting it in a script yet to push onto machines.

    We are also still seeing the issue where once a machine does a sync it applies that unknown account s-1-5-88-3-16832 with a deny rule. The next time that user tries to log in problems occur. I have no idea what that is about. We are seeing the SMB and this other s-1-5-88-3-16832 issue on 10.10.4 and 10.10.5 clients.

    @jake.snyder's solution post :

    Apple engineering provided me with a solution today. I have Windows 2008 R2 with SMB shares and my macs are running 10.9.4 and bound to AD.

    My environment seems to be working with Access Based Enumeration off and forcing SMB1 on each client.

    In order to enforce SMB1 on a mac client:

    Create the Global Config:
    $ sudo -s
    $ sudo echo "[default]" >> /etc/nsmb.conf
    $ sudo echo "smb_neg=smb1_only" >> /etc/nsmb.conf
    Restart the OS X Client
    create a new AD Test user
    Login and check if the issue still persist
    See the end of Jamf thread 10168 for more details.

    K
    Forum|alt.badge.img+1
    • kcalderw
    • New Contributor
    • September 25, 2015

    Is there a way to implement this on the machine level rather than per-user? We have a lab that I need to use this fix on.

    cdev
    Forum|alt.badge.img+14
    • cdev
    • Contributor
    • September 25, 2015

    Using the following has worked for us in under Mavericks:

    sudo sh -c "echo '[default]' >> /etc/nsmb.conf; echo 'smb_neg=smb1_only' >> /etc/nsmb.conf"

    Yosemite has worked with the same command, but we've found SMBv2 to work properly.

    Terms & ConditionsCookie settingsAccessibility statement