This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Remote Log File Archives broken after SMBv1 disabled

After disabling SMB version 1 on our Windows servers per US-CERT best practices, UTM log file archiving is broken.
Anyone have a workaround or extra information about this?

SMBv1 disabled on Windows 2008R2 and Windows 2012R2 servers via;
Registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters Registry entry: SMB1
REG_DWORD: 0 = Disabled

This thread was automatically locked due to age.

0 BAlfson over 7 years ago

The last I know, SMBv1 has to be enabled. Please let us know what Sophos Support has to say about this.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 ThomasBrewster over 7 years ago in reply to BAlfson

Internal testing indicates SMBv1 has to be enabled for the remote log archiving process to work. We're not going to pursue this with Sophos support as the SMBv1 risk appears to have been a bit overblown. We've re-enabled SMBv1 server services on the file server handling our archived logs.

Regards,
Thomas
Cancel
Vote Up 0 Vote Down

Cancel
0 mahaddon over 6 years ago in reply to ThomasBrewster

We're looking at disabling SMB1 on our DCs but when we tested this it broke our UTM AD SSO. We're still running UTM v 9.4 at the moment. Can anyone confirm that UTM still needs SMB1 for it's authentication?

Obviously we need to take this seriously because of the "wanna..." ransomware attacks
Cancel
Vote Up 0 Vote Down

Cancel
0 SIBTEL over 6 years ago in reply to mahaddon
I can confirm both issues, based on my testings :

Disabling SMB1 on the file server broke the remote log archiving (UTM 9.413-4).

Disabling SMB1 on DCs (2008 R2) broke SSO AD authentication in FireFox (curiously, no problem with IE for the moment, only Firefox).
Cancel
Vote Up 0 Vote Down

Cancel
0 mahaddon over 6 years ago in reply to SIBTEL

thanks. Yeah we're also running UTM 9.413-4 but it broke for us in IE. Think we're running 2012 DCs though
Cancel
Vote Up 0 Vote Down

Cancel
0 Matthew Dunbar over 6 years ago

Just to clarify, disabling SMBv1 doesn't affect the use of Authentication Servers; only Single Sign-on is broken after turning off SMBv1. Is that correct?
Cancel
Vote Up 0 Vote Down

Cancel
0 JamesGolden over 6 years ago in reply to Matthew Dunbar

That was what my testing revealed. With SMBv1 disabled, transparent proxy was broken. Users were not recognized by their correct AD groups. I had to re-enable SMBv1 on domain controllers at several customers.

I've got a ticket open with Sophos, but I haven't heard anything yet.

Everyone, PLEASE submit a ticket for this. Its incredible that a security company is still using such a risk-laden and obsolete protocol.
Cancel
Vote Up 0 Vote Down

Cancel
0 JamesGolden over 6 years ago

Sophos is referring to this document regarding SMBv1: https://community.sophos.com/kb/en-us/126757
Cancel
Vote Up 0 Vote Down

Cancel