SMB2 (or SMB3) support must be supported NOW!



Show first post

281 replies

Hi @Stanley_4 thanks, the new NAS would only be used to store my local Music library in fact more specifically only the music library Sonos uses (as I have more than one library). 

 

I was very tempted with your gateway solution and even think I have an old raspberry pi lying around somewhere I never really did anything with. I’m also pretty familiar with Unix (Linux) so would be able to work out what I need to do along with your very helpful instructions (thanks for posting these by the way) so if I find the pi I might have a play with that idea anyway.

In the meantime I have actually found an old 500Gb Linkstation NAS on ebay for £40 so that will do the trick and I’ve just this moment bought it convinced between my own thoughts, @el rubio ‘s response and yours. I also don’t know for 100% certain that it’s completely secure but I know it’s a lot safer than having to enable SMB1 & NTLMv1 on my main NAS server with all my other data on it. In addition having a NAS just dedicated for Sonos I can always cut any connection to the other NAS units if necessary, or maybe one day if I find that raspberry pi and I’m still not convinced that there is no vulnerability at all, I could have some fun creating some kind of hybrid solution with the disk from the NAS and the pi.

hi @Alan_77 I am using in one location a Mac mini with the Apple Music library stored on its local SSD and shared with the Sonos system. The files on the Mac are synchronised with the Synology NAS using the Synology Drive Client for backup reasons. I am not using the Apple Music cloud service. 

 

Hi @el rubio, thanks for that, it seems like we have very similar setups actually & I am broadly of the same opinion (so it seems like you are actually option 2 on my list - deciding it isn’t an issue), though if I am to understand you correctly you mean you don’t use a local library at all but stream all of your music from the (Apple) cloud?

I don’t use Sonos playlists instead using my Apple Music library and Imported playlists so also manage my music library in Music (i.e. was iTunes) then just listen to my library via Sonos.

Interesting point about tunnelling - sounds secure anyway. I am not so concerned about the sync task itself but more about having a connected device (Synology NAS) with SMB1 & NTLMv1 enabled at all. Then further to that even if I disable them from the connected NAS units whether then connecting one of these to another NAS with SMB1 could pose any security issue at all. 

Just to be clear - do you have your Synology NAS devices using SMB1 & do you connect your Sonos system or any part of it to any of your Synology NAS devices using the SMB1 protocol?

 

 

Userlevel 7
Badge +22

In your situation I really like the SMB v1 Gateway solution, on a Pi or any other SMB v1 supporting system that does not contain important data.

There are several steps to get it working but you do that once, make a backup SD card and never have to do it again. In my case, since the gateway is not visible outside my local network I just set it up and let it run. I feel no need to do OS updates or anything else after the initial setup.

Before rebooting it in an attempt to get the album art working again my Sonos/Pi had been running about 150 days with me never logging in to do anything.

 

The new-NAS puts you in the same situation as the SMB v1 NAS for Sonos which is what I’m running here. Less user setup, more money and you need to remember to not let any connected system put important data on it.

You do not need to use SMB v1 for any connection but to your Sonos so you could connect your NAS devices together using SMB 2/3 to copy/paste music data between. That wouldn’t be a great solution, a NAS based tool like rsync would be much preferred.

How the SMBv1 vulnerabilities leak between machines is beyond my skill-set, I don’t do Windows or Mac so I rarely use it. I do know with the gateway setup and a read-only NFS link from your other NAS there is no issue.

If looking at an older NAS that is going to connect outside your LAN (many need to do so) beware the end of life issue. My MyBook Live went out of support a year after I got it and I felt it was unsafe to have running. I did block it at the firewall and as it was IPv4 only that was simple, a newer IPv6 capable device can be much more difficult to block.

 

hi @Alan_77 despite all the hype about SMBv1, I have stayed with Sonos and even expanded the number of speakers - I deploy several Synology NAS in different locations (read: premises/countries) of which two are synchronised using Synology Drive Share sync. The synchronisation between the Synology NAS is using a tunnel (created with the Quickconnect ) and has in my view no impact on the SMB issue which is related to your local file services protocols. Anyway, while the SMBv2 issues seem to being fixed, I am not using Sonos libraries because of the poor features with regards to playlists and manage my tracks with Apple Music and AirPlay streaming. Nevertheless, Sonos and Synology are, in my humble opinion, good products which I continue to use.

 
 

Hi All,

 

I hope someone on here can help advise me.

 

I have read through the majority of this discussion and am considering various options between:

  1. (preferred option) Buying yet another NAS (I just bought 2 DS220j’s recently in addition to a DS213j I already had so originally intending 2 NAS drives I’d be ending up with 4!!) - a cheap one which I would use locally not connected to the internet and just for Sonos
  2. Deciding I am probably safe to continue linking my (very) old Sonos setup (think Zoneplayer 100) to my new Synology NAS running DSM 7 and choosing to ignore the warnings and use SMB1 &  NTLMv1 to keep my Sonos system working despite having a much better NAS solution which warns me otherwise not to mention the warnings on this forum - on the basis that an attack would need to guess my passwords and they are very secure (with admin account disabled on my NAS for example)
  3. Adopting Stan’s pi solution (though I do have some questions about that and it does look a little involved)
  4. Using Plex which I can install on my NAS server and accessing my music library via Plex (though not really sure I like the idea of the extra unnecessary layer and change in interface and potentially useability - e.g. does Plex import Apple Music playlists and present them via the Sonos controller in the same way?)

For context I’ve used Sonos for years and always with a NAS so that I can connect to it quickly without the need for computers to be running. 

So I am favouring option 1.

I now have 3 NAS devices in different locations synchronising to each other via the internet (Quickconnect) on a semi-regular basis. As my music library is important to me I’d like to keep a copy backed up on these devices but would have it on a new 4th NAS connected to my local network.

With this setup I would then need to synchronise this new NAS (I’m thinking something like a cheap old Buffalo Linkstation) with my new DS220j NAS at home which is in turn synchronising across the internet with the other two. 

My question is this: if my 3 Synology NAS drives are secure running only SMB 2 & 3, NTLM disabled but one of them is connecting to the new local NAS running SMB1 to synchronise & backup my music library, could that be offering up any vulnerability as because the devices are connected? I’m pretty sure it would be completely safe as the internet connected NAS’s would be secure and only have one dedicated connection to the new NAS for synchronisation purposes (which should be safe assuming a locally setup connection (even with SMB1) for that specific purpose) - but you can never be too sure and though I know a fair bit about IT I’m not an expert at the network level so couldn’t say for sure that this would be a safe setup.

 

Both the Sonos connection and the sync between New NAS & DS220j would have distinct, secure and dedicated usernames & passwords.

 

It seems to be the best solution to continue using Sonos given I can probably pick up a smallish single bay old NAS drive for very little these days (and maybe even less given the known SMB1 issue quickly making some of these older devices pretty redundant except for very specific purposes like this).

 

I hope that makes sense, could someone advise?

I got my Synology already working with SMBv2 for a while and shared my experience in this post

 

Could be. If you disable smb1 then Sonos speaker auto connected to smb2 (obviously). What I did is left smb1 and risen the maximum smb to smb3. Speaker auto recognized it and connected to smb3. Later on I completely disabled smb1 and all continued to work.

So, to solve Sonos to Synology interconnection either disable smb v1 or allow smb3 as maximum smb allowed. This worked to you or latter to me. 

I got my Synology already working with SMBv2 for a while and shared my experience in this post

 

I join the requirements to introduce support for SMB2 and SMB3.  2022 is coming soon!

 

Read the thread, particularly the post above yours.  It’s already here. 

I guess biggest issue here is NTLMv1 not really SMB versions. My Sonos speaker cannot access Synology as NTLMv1 is security risk.

 

EDIT: When I’ve enabled SMB v3 on Synology (by default it was up to SMB v2 only) actually I can again connect to Synology.

I join the requirements to introduce support for SMB2 and SMB3.  2022 is coming soon!

 

Read the thread, particularly the post above yours.  It’s already here. 

I join the requirements to introduce support for SMB2 and SMB3.  2022 is coming soon!

Userlevel 2
Badge

I want to use my Sonos with my Synology without using an insecure filesharing protocol. Is that really such a tough ask?

Did you see my comment below?

“I hesitate to say this, but my Amp and Ones appear to be talking to my Synology NAS using SMB3 now.  All devices and controllers are running S2 v13.4.”

I want to use my Sonos with my Synology without using an insecure filesharing protocol. Is that really such a tough ask?

Userlevel 7
Badge +17

That would be great! Any news about the 65k limit?

Userlevel 2
Badge

I hesitate to say this, but my Amp and Ones appear to be talking to my Synology NAS using SMB3 now.  All devices and controllers are running S2 v13.4.

Userlevel 7
Badge +21

We are writing summer 2019 and still Sonos only supports SMB version 1 for the Music Library share.



This is not acceptable.



A file share running SMB1 is extremely vulnerable to all the variants of cryptolocker virus that exists today. File share servers (NAS, Windows, Apple OS) can only support one version of SMB - so you cannot from the same box have one file share (for Sonos) using SMB1 and the other file shares using SMB2 or SMB3. This way Sonos puts each and every file share at serious risc - just because they don’t update their file share protocol to comply with this century.



And for the record - the “solution” through PLEX is not a solution. Unstable at best.

2 years after this post SONOS have still not resolved this issue. They forced us to upgrade to V2 products to “enable new functionality” but their customers security apparently isn’t important to them. BlueSound do recognise the issues with SMBv1! 

 

Sonos have confirmed they are working on the issue and plan for SMB 3 support.  No date has been given, nor is that likely to be given until it arrives.

 

I suggest you go with Bluesound if it is that vital to you.  Not sure what the forcing was for S2 is about, none of the new functions affects the prime music playing functions, it was more to support new devices from what i can see, as well as Dolby Atmos

We are writing summer 2019 and still Sonos only supports SMB version 1 for the Music Library share.



This is not acceptable.



A file share running SMB1 is extremely vulnerable to all the variants of cryptolocker virus that exists today. File share servers (NAS, Windows, Apple OS) can only support one version of SMB - so you cannot from the same box have one file share (for Sonos) using SMB1 and the other file shares using SMB2 or SMB3. This way Sonos puts each and every file share at serious risc - just because they don’t update their file share protocol to comply with this century.



And for the record - the “solution” through PLEX is not a solution. Unstable at best.

2 years after this post SONOS have still not resolved this issue. They forced us to upgrade to V2 products to “enable new functionality” but their customers security apparently isn’t important to them. BlueSound do recognise the issues with SMBv1! 

 

Userlevel 7
Badge +23

bockersjv,

 

Thanks for the response.

I’m now aware that my original assumption that the Controller was what serves local files was incorrect.

It is interesting, as to an end user, it isn’t obvious that the Controller (GUI) software is a separate piece of code than the HTTP server that provides music files to the speakers. They are, after all, installed together.

I have to say, with knowledge of the distinction between the two pieces of software, I believe my original premise stands.

I don’t see why support for brokering network file shares through the HTTP server that’s already running on a local PC couldn’t be added. This would certainly be an easier engineering task than trying to get a larger Linux kernel loaded into the older speakers. And, it would have the benefit of working with the investment that folks have already made into old and newer hardware.

It would also mean that it’s possible to avoid running a Raspberry Pi with flawed software - which seems to already suffer from the “additional wireless hops into the music path” problem.


For sharing files on a PC, it makes sense that the PC is powered on, and running the http server. No-one needs to be logged in though, and certainly no controller needs to be running.

For sharing files from a NAS however, requiring that a PC also be powered on to run the http server as a proxy, seems sub-optimal. Else why even use a NAS: put the files on the PC in the first place.

The “correct” solution would be to run the Sonos http server on the NAS itself. This is not difficult technically, but no-one seems interested enough to do this.

bockersjv,

 

Thanks for the response.

I’m now aware that my original assumption that the Controller was what serves local files was incorrect.

It is interesting, as to an end user, it isn’t obvious that the Controller (GUI) software is a separate piece of code than the HTTP server that provides music files to the speakers. They are, after all, installed together.

I have to say, with knowledge of the distinction between the two pieces of software, I believe my original premise stands.

I don’t see why support for brokering network file shares through the HTTP server that’s already running on a local PC couldn’t be added. This would certainly be an easier engineering task than trying to get a larger Linux kernel loaded into the older speakers. And, it would have the benefit of working with the investment that folks have already made into old and newer hardware.

It would also mean that it’s possible to avoid running a Raspberry Pi with flawed software - which seems to already suffer from the “additional wireless hops into the music path” problem.

Userlevel 7
Badge +21

Presumably, that means you think I’m a troll. That’s not the case.

But, I don’t enjoy discussions with someone that’s being intentionally obtuse. I guess that makes me a troll.

Regardless, I still don’t understand why this software issue couldn’t have been resolved outside of the domain of the speakers themselves - if Sonos is responsible for running an HTTP server that serves local music files to the speakers, that HTTP server could be configured to proxy bytes off of an SMBv2/3 share.

I’m happy to drop out of this conversation as there seems to be a toxic culture here. I guess that I needed to spend more time learning nomenclature and system architecture before asking a question.

Otherwise, a basic question becomes a syntactical journey on why mobile devices can’t support something entirely unrelated. It seems you lot have invested a bunch of history here and it’s not a healthy place to pose an honest query.

Lastmuel, my apologies. Seems i was too hasty. 
The trouble is you assume the app does some work for the system once music is playing. In reality it does little, which is why you can close it without the stream stopping.  It’s just a remote control to the speakers when playing from a music share. If there was a simpler way it would have been put into effect ages ago. The firmware on the speakers does all the heavy lifting and for the older  speakers the space for adding smb 2 or 3 was insufficient. I’m sure I’d Sonos knew this 10 years ago their architecture would be different. 
S2, and newer speakers has doubtless opened up options and we now hear SMB upgrades are on the cards it’s great news. 

And again my apologies, there have been a lot of previous cases of people signing in just to troll on issues, mainly not being able to play music direct from ios devices. They post a load of negative posts only to disappear. Look back at some of the negative posts at the beginning of this thread gives you an taste too. 
 

 

Presumably, that means you think I’m a troll. That’s not the case.

But, I don’t enjoy discussions with someone that’s being intentionally obtuse. I guess that makes me a troll.

 

 

I didn’t see it as a trolling case personally.  Perhaps a matter of semantics, but the incorrect idea that the controller software is involved in the delivery of music to the speakers is a common one  I get that you’re intermingling the Sonos software for control and software/service is involved with delivery of local libraries, and that difference is irrelevant to you...but lack of clarity on the role of the Sonos controller software has caused much confusion in other discussions.

 

 

 

 

Presumably, that means you think I’m a troll. That’s not the case.

But, I don’t enjoy discussions with someone that’s being intentionally obtuse. I guess that makes me a troll.

Regardless, I still don’t understand why this software issue couldn’t have been resolved outside of the domain of the speakers themselves - if Sonos is responsible for running an HTTP server that serves local music files to the speakers, that HTTP server could be configured to proxy bytes off of an SMBv2/3 share.

I’m happy to drop out of this conversation as there seems to be a toxic culture here. I guess that I needed to spend more time learning nomenclature and system architecture before asking a question.

Otherwise, a basic question becomes a syntactical journey on why mobile devices can’t support something entirely unrelated. It seems you lot have invested a bunch of history here and it’s not a healthy place to pose an honest query.

Userlevel 7
Badge +21

All

Sonos have confirmed they are looking into SMB upgrades.  See this thread:-

 

Danny, you can stop feeding now ;)

controlav,

 

If I have local music files that are only accessible via an HTTP service running - a service that is part of the Sonos controller install - how is it that the software is never, ever, REQUIRED?

 

 

The service and controller application are two distinct things.  Whether or not the service is installed when the controller is installed is irrelevant. 

 

How do the speakers get access to those local files without a SONOS http service running? Are the speakers caching music when I turn my PC off? Clearly SONOS is running a service that allows the speakers to access those bytes AND the PC is required to be running for those bytes to be available to the speakers.

 

 

This is correct, but you are now talking about a service rather than the controller app. 

 

 

I would like to propose a test for your assertion that “Sonos does not, and will never, REQUIRE a controller to be alive and running in order to play music.”.

Please test this on your local setup and share your results:

  1. Install the controller software on a PC of your choice
  2. Add local music files to your controller software and music library so that the speakers can access that music.
  3. Turn off your computer.
  4. Play music from your library on your SONOS speakers.

I will await your results.

 

If your music library is located on a NAS or some other computer, it will work just fine.   If the music files are on the PC you just turned off from power, it won’t.  A better test would be replace step 3  with ‘close the Sonos controller program’ or even ‘uninstall the Sonos controller program’ for the case where the PC hold the music files.

controlav,

 

If I have local music files that are only accessible via an HTTP service running - a service that is part of the Sonos controller install - how is it that the software is never, ever, REQUIRED?

 

How do the speakers get access to those local files without a SONOS http service running? Are the speakers caching music when I turn my PC off? Clearly SONOS is running a service that allows the speakers to access those bytes AND the PC is required to be running for those bytes to be available to the speakers.

 

I would like to propose a test for your assertion that “Sonos does not, and will never, REQUIRE a controller to be alive and running in order to play music.”.

Please test this on your local setup and share your results:

  1. Install the controller software on a PC of your choice
  2. Add local music files to your controller software and music library so that the speakers can access that music.
  3. Turn off your computer.
  4. Play music from your library on your SONOS speakers.

I will await your results.

Reply