Just updated to a new security appliances with lots of performance and smbfs is greatly slowed down and/or stops when connection to my NAS (linux based appliance (QNAP)). It will then lock up Ambient or really slow it down but I can still use the task bar to load apps.

Wayfarer and Iris seem fine however and seem a bit faster.

Any ideas why SMBFS is not working? It worked fine with my slower/older appliance.

Is there a better substitute?

[ Edited by matt3 26.08.2022 - 23:24 ]

It is probably caused by the fact that SMBFS is still supporting the old SMB1 protocol only and QNAP has taken some measures to prevent accessing it via this protocol due to security concerns.

Ambient probably lags and/or is slowed down because some internal network communication inside the filesystem takes way too much time. And SMBFS can only deal with one request at a time, so it basically blocks if there are more requests incoming ...

Unfortunately, supporting a newer protocol version would basically mean a complete rewrite of SMBFS more or less - which should probably be done anyway.
I guess we need to do it at some point but it is not on our top priority list right now.

AFAICT, there is no substitute for it currently. Is there some way in your NAS to allow legacy SMB support again maybe ?

@CYFN Thanks for that.

I did a lot more testing and I found if I turned off IPS on the new security device it fixed the issue. Not only with Morphos but also other computers trying to play large movie files.

Strange that IPS would do this? So I don't think it is the QNAP but the new security appliance. Strange because is has a lot of cpu grunt and power and is a new next gen device...

[ Edited by matt3 27.08.2022 - 13:39 ]

Quote:
It's hard to know for sure, but this is my take on this:

IPS typically works by inspecting the network traffic realtime. Since it has to be able to prevent intrusion, it will need to do decisions on each packet whether to pass or block it. This adds latency, which will have negative impact on network performance. MorphOS network stack specifically is rather sensitive to excessive latency.

Thanks Piru,

How much of a risk is it to turn off IPS?



Quote:

Quote:
I can't possibly know what your threat model is so it would be unwise for me to give absolute advice on this.

If it is possible to exclude hosts or protocols from IPS you could try excluding the MorphOS box or samba/CIFS protocol. It's possible that this way it would not have the detrimental effect on the samba performance.

As always, disabling IPS coverage does reduce the security it provides. It's up to you to decide if this is acceptable.

[ Edited by Piru 27.08.2022 - 23:06 ]

I will trying turning off IPS for the LAN and leaving it on for the WAN.

Quick update, I turned off everything (Geoblocking, IPS, Virus, Maleware, Bots) so in my mind it is just a router with a NAT firewall. MorphOS sorta works now, at least. It can read the NAS. It still is slow and sometimes I get the hourglass when I click the nas or its folders. Sometimes it locks ambient and will eventually come back.

I'm having other issues just streaming movies well across it on the pc. Getting out to the internet works fine for the most part, just issues on the lan.

Quote:

OK, I figured it out.

Something in my network (switches or wires maybe) are the issue. I portshielded directly to the device a bunch of stuff including MOS. Every worked perfect even with everything turned on.

Crazy since the old linksys router I used works perfect in the same network...

Oh well..

Quick update:

I updated the firmware on the NAS and SMB1 was disabled. I was able to get around it in the end, but as mentioned earlier in this thread SMBv1 is being phased out because of all the ransomware attacks that exploit v1.

Quote:

"Being phased out" is a curious choice of words. It may be almost a decade now that it's been disabled in Windows by default. CIFS filesystem on Linux, and Windows via adjusting group management settings, can still access it via switches if required. I suppose you mean that these workarounds may someday be removed, which is likely at least for Windows.

I know this pain, as I own two NAS and a SMB-capable media player and they all, while being still in perfect working order and daily use, require SMBv1 connections. (I was kinda copying for new EU legislation to force vendors to push security updates to their devices for a decade to come in soon, but then we left the EU and now we have sewage in our sea and bankers bonuses caps removed, so there's that...) Wouldn't help me though, my stuff is ancient.

Edit: I think it's a shame that standalone computers like Raspberry Pi are so badly limited when it comes to SATA and handle all their USB on the same PCI lane, or they'd make a nice NAS. The Pi4 at least separates network and USB on different lanes but it runs too hot to be a real NAS. There has been a sudden price drop in a lot of Mini x64 PCs lately, but they do tend to also run hot... and suck.

[ Edited by KennyR 18.09.2022 - 12:26 ]

I'm not even sure it's still possible to configure smbd itself to accept SMBv1 connections. I just ran testparm on my Pi and it said all the options were deprecated.

Edit: The addition of

ntlm auth = ntlmv1-permitted

to smb.conf will still allow SMBv1 and access via MorphOS.

...for now.

[ Edited by KennyR 18.09.2022 - 12:44 ]

We sure need to come up with a replacement solution at some point but this is nowhere near right now, at least not from any of the MorphOS Team developers afaict.

Just for info: MacOS X 10.5.8 Leopard is connecting via SMB1(NT1) to a new Samba Server (simple smb.conf): Hyperion-Forum

[ Editiert durch xeno74 18.09.2022 - 18:16 ]

I'm good to go now that I know how to change to SMB1. Lots of warnings that I will be letting ransomware in and destroying the known universe. But I'm good.

I appreciate that MorphOS works well on the NAS now. The Sync2 also does a nice job keeping a few folders updated.

The risks are much less if you're just operating on your own LAN. (The internet should never be allowed to access SMB ports regardless of how secure, obviously.)

If you're operating on a laptop though and take it onto a work, library or uni LAN with SMBv1 active and that's where you'll have trouble.

Thanks for the explanation Kenny.

Think I'm good to go now, everything is running well. I wish 2.5Gb switches were cheaper and more plentiful!

Quote:

The latest QNAP updates have disabled SMB1 by default. IF you want to still use it they have an option in the settings to enable legacy 1.0 services again. Turn it on and it will be faster again at the risk of less security of course.

Quote:

See #12.