|
Server Message Block (SMB) is an application-level network protocol mainly applied to shared access to files, printers, serial ports, and miscellaneous communications between nodes on a network. It also provides an authenticated Inter-process communication mechanism. It is mainly used by Microsoft Windows equipped computers.
History SMB was originally invented by Barry Feigenbaum at IBM to turn DOS "Interrupt 33" local file access into a networked file system, but the most common version is modified heavily by Microsoft. Microsoft merged the SMB protocol with the LAN Manager product they had been developing with 3Com, and continued to add features to the protocol in Windows for Workgroups and later versions of Windows. SMB was originally designed to run on top of the NetBIOS protocol (which itself is typically run on NetBEUI, IPX/SPX or NBT), though SMB can also run on top of TCP/IP directly, a feature introduced with Windows 2000. "SMB the protocol" is not to be confused with the SMB services that run on it, nor with NetBIOS, nor with the DCE/RPC services that use SMB as an authenticated Inter-process communication channel (over named pipes), nor with the "Network Neighborhood" protocols which primarily but not exclusively run as datagram services directly on the NetBIOS transport. At around the time when Sun Microsystems announced WebNFS *, Microsoft launched an initiative in 1998 to rename SMB to Common Internet File System (CIFS), and added more features, including support for symbolic links, hard links, larger file sizes and an attempt at supporting direct connection without all the NetBIOS trimmings - an effort that was largely experimental and required further refinement. Because of the importance of the SMB protocol in interacting with the dominant Microsoft Windows platform, coupled with the heavily modified nature of the SMB implementation present in that platform, the Samba project was created to provide a free implementation of a compatible SMB client and server for use with non-Microsoft operating systems. Client-server approach SMB works through a client-server approach, where a client makes specific requests and the server responds accordingly. One section of the SMB protocol is specifically for filesystem access, such that clients may make requests to a file server, but there are other sections of the SMB protocol that specialise in inter-process communication - IPC. The SMB protocol was optimised for local subnet usage, but one could use it to access different subnets across the internet – on which Windows file-and-print sharing exploits usually focus. SMB servers make their file systems and other resources available to clients on the network. Client computers may have their own hard disks, which are not publicly shared, yet also want access to the shared file systems and printers on the server, and it is for this primary purpose that SMB is best known and most heavily used. However, the SMB file server aspect would be as nothing if it was not for the NT Domains suite of protocols, which provide NT-style Domain-based authentication at the very least. The NT Domains protocols are MSRPC services that are almost exclusively available on SMB IPC "named pipes", and almost all implementations of SMB servers use NT Domain authentication to validate user access to resources. Performance issues It is often believed that the SMB protocol makes heavy use of network bandwidth because each client broadcasts its presence to the whole subnet. SMB itself does not use broadcasts. The broadcast problems commonly associated with SMB are actually caused by the NetBIOS service location protocol. By default, a Microsoft Windows server will use NetBIOS to advertise and locate services. NetBIOS functions by broadcasting services available on a particular host at regular intervals. While this is usually an acceptable default for a network with less than 20 hosts, broadcast traffic will cause problems as the number of hosts increases. This problem can be mitigated by a proper implementation of the Windows Internet Naming Service (WINS) service location protocol. WINS uses a much more advanced system of registration and centralized service requests, but imposes its own complexity upon the design and maintenance of the network. Microsofts modifications In order to provide a more seamless computing experience by hiding far-sighted and comprehensive complexity behind powerfully simple (and sometimes possibly oversimplified) interlinked interfaces, Microsoft has added several important features to its own SMB implementation that expand on the original concept. For example, NTLM Version 2 was added because NTLM version 1 (which is derived from the original legacy SMB specification's requirement to use IBM "LanManager" passwords) uses DES in a flawed manner. Additionally, the NT 4.0 Domain Logon protocols use 40-bit encryption outside of the United States, which is insecure by modern standards. Points of interest SMB's "Inter-Process Communication" mechanism deserves a specific mention. Over the SMB "IPC" system, named pipes are provided. SMB's IPC mechanism is one of the first few inter-process mechanisms commonly available to programmers that provides a means for services to inherit the authentication that was carried out when a client first connects to an SMB server. Named pipes inherited authentication is so ubiquitous and transparent that it is often simply taken for granted by programmers using the Windows API and Windows users alike. Bizarrely, though, some services that operate over named pipes, such as those which use Microsoft's own implementation of DCE/RPC over SMB, known as MSRPC over SMB, also allow MSRPC client programs to perform authentication, which over-rides the authorization provided by the SMB server, but only in the context of the MSRPC client program that successfully makes the additional authentication. SMB is also used as the basis for Microsoft's Distributed File System implementation. Alternative versions and implementations This list below explicitly refers to "SMB" to include an SMB client and/or an SMB server, plus the various protocols that make SMB useful, such as the Network Neighborhood suite of protocols and the NT Domains suite. For simplicity and conciseness however, no mention of the extent or completeness of the reimplementation or porting status is mentioned for any of these implementation, and they are all "lumped" together and referred to simply as "SMB". See also | ||||||||
|
| |||||||||
 |
|
| |