diff options
Diffstat (limited to 'fs/cifs/Kconfig')
| -rw-r--r-- | fs/cifs/Kconfig | 59 |
1 files changed, 31 insertions, 28 deletions
diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig index 5f132d59dfc2..35c83fe7dba0 100644 --- a/fs/cifs/Kconfig +++ b/fs/cifs/Kconfig @@ -16,24 +16,28 @@ config CIFS select CRYPTO_DES help This is the client VFS module for the SMB3 family of NAS protocols, - as well as for earlier dialects such as SMB2.1, SMB2 and the + (including support for the most recent, most secure dialect SMB3.1.1) + as well as for earlier dialects such as SMB2.1, SMB2 and the older Common Internet File System (CIFS) protocol. CIFS was the successor to the original dialect, the Server Message Block (SMB) protocol, the native file sharing mechanism for most early PC operating systems. - The SMB3 protocol is supported by most modern operating systems and - NAS appliances (e.g. Samba, Windows 8, Windows 2012, MacOS). + The SMB3 protocol is supported by most modern operating systems + and NAS appliances (e.g. Samba, Windows 10, Windows Server 2016, + MacOS) and even in the cloud (e.g. Microsoft Azure). The older CIFS protocol was included in Windows NT4, 2000 and XP (and later) as well by Samba (which provides excellent CIFS and SMB3 - server support for Linux and many other operating systems). Limited - support for OS/2 and Windows ME and similar very old servers is - provided as well. + server support for Linux and many other operating systems). Use of + dialects older than SMB2.1 is often discouraged on public networks. + This module also provides limited support for OS/2 and Windows ME + and similar very old servers. - The cifs module provides an advanced network file system client + This module provides an advanced network file system client for mounting to SMB3 (and CIFS) compliant servers. It includes support for DFS (hierarchical name space), secure per-user - session establishment via Kerberos or NTLM or NTLMv2, - safe distributed caching (oplock), optional packet + session establishment via Kerberos or NTLM or NTLMv2, RDMA + (smbdirect), advanced security features, per-share encryption, + directory leases, safe distributed caching (oplock), optional packet signing, Unicode and other internationalization improvements. In general, the default dialects, SMB3 and later, enable better @@ -43,18 +47,11 @@ config CIFS than SMB3 mounts. SMB2/SMB3 mount options are also slightly simpler (compared to CIFS) due to protocol improvements. - If you need to mount to Samba, Macs or Windows from this machine, say Y. - -config CIFS_STATS - bool "CIFS statistics" - depends on CIFS - help - Enabling this option will cause statistics for each server share - mounted by the cifs client to be displayed in /proc/fs/cifs/Stats + If you need to mount to Samba, Azure, Macs or Windows from this machine, say Y. config CIFS_STATS2 bool "Extended statistics" - depends on CIFS_STATS + depends on CIFS help Enabling this option will allow more detailed statistics on SMB request timing to be displayed in /proc/fs/cifs/DebugData and also @@ -66,9 +63,24 @@ config CIFS_STATS2 Unless you are a developer or are doing network performance analysis or tuning, say N. +config CIFS_ALLOW_INSECURE_LEGACY + bool "Support legacy servers which use less secure dialects" + depends on CIFS + default y + help + Modern dialects, SMB2.1 and later (including SMB3 and 3.1.1), have + additional security features, including protection against + man-in-the-middle attacks and stronger crypto hashes, so the use + of legacy dialects (SMB1/CIFS and SMB2.0) is discouraged. + + Disabling this option prevents users from using vers=1.0 or vers=2.0 + on mounts with cifs.ko + + If unsure, say Y. + config CIFS_WEAK_PW_HASH bool "Support legacy servers which use weaker LANMAN security" - depends on CIFS + depends on CIFS && CIFS_ALLOW_INSECURE_LEGACY help Modern CIFS servers including Samba and most Windows versions (since 1997) support stronger NTLM (and even NTLMv2 and Kerberos) @@ -186,15 +198,6 @@ config CIFS_NFSD_EXPORT help Allows NFS server to export a CIFS mounted share (nfsd over cifs) -config CIFS_SMB311 - bool "SMB3.1.1 network file system support" - depends on CIFS - select CRYPTO_SHA512 - - help - This enables support for the newest, and most secure dialect, SMB3.11. - If unsure, say Y - config CIFS_SMB_DIRECT bool "SMB Direct support (Experimental)" depends on CIFS=m && INFINIBAND && INFINIBAND_ADDR_TRANS || CIFS=y && INFINIBAND=y && INFINIBAND_ADDR_TRANS=y |