SMB2 (or SMB3) support must be supported NOW!

Hi All,

I hope someone on here can help advise me.

I have read through the majority of this discussion and am considering various options between:

1. (preferred option) Buying yet another NAS (I just bought 2 DS220j’s recently in addition to a DS213j I already had so originally intending 2 NAS drives I’d be ending up with 4!!) - a cheap one which I would use locally not connected to the internet and just for Sonos
2. Deciding I am probably safe to continue linking my (very) old Sonos setup (think Zoneplayer 100) to my new Synology NAS running DSM 7 and choosing to ignore the warnings and use SMB1 &  NTLMv1 to keep my Sonos system working despite having a much better NAS solution which warns me otherwise not to mention the warnings on this forum - on the basis that an attack would need to guess my passwords and they are very secure (with admin account disabled on my NAS for example)
3. Adopting Stan’s pi solution (though I do have some questions about that and it does look a little involved)
4. Using Plex which I can install on my NAS server and accessing my music library via Plex (though not really sure I like the idea of the extra unnecessary layer and change in interface and potentially useability - e.g. does Plex import Apple Music playlists and present them via the Sonos controller in the same way?)

For context I’ve used Sonos for years and always with a NAS so that I can connect to it quickly without the need for computers to be running. 

So I am favouring option 1.

I now have 3 NAS devices in different locations synchronising to each other via the internet (Quickconnect) on a semi-regular basis. As my music library is important to me I’d like to keep a copy backed up on these devices but would have it on a new 4th NAS connected to my local network.

With this setup I would then need to synchronise this new NAS (I’m thinking something like a cheap old Buffalo Linkstation) with my new DS220j NAS at home which is in turn synchronising across the internet with the other two. 

My question is this: if my 3 Synology NAS drives are secure running only SMB 2 & 3, NTLM disabled but one of them is connecting to the new local NAS running SMB1 to synchronise & backup my music library, could that be offering up any vulnerability as because the devices are connected? I’m pretty sure it would be completely safe as the internet connected NAS’s would be secure and only have one dedicated connection to the new NAS for synchronisation purposes (which should be safe assuming a locally setup connection (even with SMB1) for that specific purpose) - but you can never be too sure and though I know a fair bit about IT I’m not an expert at the network level so couldn’t say for sure that this would be a safe setup.

Both the Sonos connection and the sync between New NAS & DS220j would have distinct, secure and dedicated usernames & passwords.

It seems to be the best solution to continue using Sonos given I can probably pick up a smallish single bay old NAS drive for very little these days (and maybe even less given the known SMB1 issue quickly making some of these older devices pretty redundant except for very specific purposes like this).

I hope that makes sense, could someone advise?

hi @Alan_77 despite all the hype about SMBv1, I have stayed with Sonos and even expanded the number of speakers - I deploy several Synology NAS in different locations (read: premises/countries) of which two are synchronised using Synology Drive Share sync. The synchronisation between the Synology NAS is using a tunnel (created with the Quickconnect ) and has in my view no impact on the SMB issue which is related to your local file services protocols. Anyway, while the SMBv2 issues seem to being fixed, I am not using Sonos libraries because of the poor features with regards to playlists and manage my tracks with Apple Music and AirPlay streaming. Nevertheless, Sonos and Synology are, in my humble opinion, good products which I continue to use.

In your situation I really like the SMB v1 Gateway solution, on a Pi or any other SMB v1 supporting system that does not contain important data.

There are several steps to get it working but you do that once, make a backup SD card and never have to do it again. In my case, since the gateway is not visible outside my local network I just set it up and let it run. I feel no need to do OS updates or anything else after the initial setup.

Before rebooting it in an attempt to get the album art working again my Sonos/Pi had been running about 150 days with me never logging in to do anything.

The new-NAS puts you in the same situation as the SMB v1 NAS for Sonos which is what I’m running here. Less user setup, more money and you need to remember to not let any connected system put important data on it.

You do not need to use SMB v1 for any connection but to your Sonos so you could connect your NAS devices together using SMB 2/3 to copy/paste music data between. That wouldn’t be a great solution, a NAS based tool like rsync would be much preferred.

How the SMBv1 vulnerabilities leak between machines is beyond my skill-set, I don’t do Windows or Mac so I rarely use it. I do know with the gateway setup and a read-only NFS link from your other NAS there is no issue.

If looking at an older NAS that is going to connect outside your LAN (many need to do so) beware the end of life issue. My MyBook Live went out of support a year after I got it and I felt it was unsafe to have running. I did block it at the firewall and as it was IPv4 only that was simple, a newer IPv6 capable device can be much more difficult to block.

Hi @el rubio, thanks for that, it seems like we have very similar setups actually & I am broadly of the same opinion (so it seems like you are actually option 2 on my list - deciding it isn’t an issue), though if I am to understand you correctly you mean you don’t use a local library at all but stream all of your music from the (Apple) cloud?

I don’t use Sonos playlists instead using my Apple Music library and Imported playlists so also manage my music library in Music (i.e. was iTunes) then just listen to my library via Sonos.

Interesting point about tunnelling - sounds secure anyway. I am not so concerned about the sync task itself but more about having a connected device (Synology NAS) with SMB1 & NTLMv1 enabled at all. Then further to that even if I disable them from the connected NAS units whether then connecting one of these to another NAS with SMB1 could pose any security issue at all. 

Just to be clear - do you have your Synology NAS devices using SMB1 & do you connect your Sonos system or any part of it to any of your Synology NAS devices using the SMB1 protocol?

hi @Alan_77 I am using in one location a Mac mini with the Apple Music library stored on its local SSD and shared with the Sonos system. The files on the Mac are synchronised with the Synology NAS using the Synology Drive Client for backup reasons. I am not using the Apple Music cloud service. 

Hi @Stanley_4 thanks, the new NAS would only be used to store my local Music library in fact more specifically only the music library Sonos uses (as I have more than one library). 

I was very tempted with your gateway solution and even think I have an old raspberry pi lying around somewhere I never really did anything with. I’m also pretty familiar with Unix (Linux) so would be able to work out what I need to do along with your very helpful instructions (thanks for posting these by the way) so if I find the pi I might have a play with that idea anyway.

In the meantime I have actually found an old 500Gb Linkstation NAS on ebay for £40 so that will do the trick and I’ve just this moment bought it convinced between my own thoughts, @el rubio ‘s response and yours. I also don’t know for 100% certain that it’s completely secure but I know it’s a lot safer than having to enable SMB1 & NTLMv1 on my main NAS server with all my other data on it. In addition having a NAS just dedicated for Sonos I can always cut any connection to the other NAS units if necessary, or maybe one day if I find that raspberry pi and I’m still not convinced that there is no vulnerability at all, I could have some fun creating some kind of hybrid solution with the disk from the NAS and the pi.

(anyone listening) am I right in thinking that the only way the SMB1 or NTLMv1 weaknesses can be exploited is if the offending party or software has a valid login to the server with the password (and this would have to be in the list of local users or internal system users on the device) so if I have a few trusted users and my passwords are all very strong (and I’m careful about what I install and the access given to programs) then the SMB issue isn’t really much of an issue at all?

Hi @el rubio ah I see, I understand.

Well I guess that would work quite well but in my case I always preferred historically to not need to have a computer left switched on. That being said I do also have an old Mac mini which I no longer use that I could have used just for that purpose now you mention it. Probably consumes quite a bit more electricity than a NAS though but given the Sonos limitations we’re discussing here not a bad solution. I bought the Linkstation NAS now though.

A man can never have too many NAS drives.

hi @Alan_77 you may find many opinions on this forum about the vulnerability - in my humble opinion, the first ‘perimeter’ to hack is your router firewall or your wifi network, next is indeed getting onto the NAS - strong passwords use and setting read-only access is one of the ways to mitigate the risks

Correct.  Although the sturm and drang over this issue is huge, there’s not been one documented case of malicious hacking of a Sonos library due to SMB1 weaknesses.