Forcing SMB1 with smbclient.md

Forcing SMB1 with smbclient

$ smbclient //HOST/SHARE -U USER -m NT1 --option='client min protocol=NT1'

This short command tells the Samba smbclient tool to connect to a remote SMB/CIFS share using the SMB1 (NT1) protocol dialect. //HOST/SHARE is the UNC path to the server and share, and -U USER supplies the username for authentication. (samba.org)

Flag breakdown:

• -m NT1 (or --max-protocol=NT1 in some docs) forces the client to use the NT1 dialect (SMB1) when negotiating with the server. This overrides the default behavior of negotiating the highest mutually supported SMB version. (samba.org)
• --option='client min protocol=NT1' sets the equivalent Samba client configuration option at runtime, lowering the minimum protocol the client will attempt; this makes smbclient accept SMB1-only servers. The same setting can be placed in /etc/samba/smb.conf under [global]. (samba.org)

Security note (important): SMB1 is obsolete and has well-known, serious vulnerabilities — it is disabled or not installed by default on modern Windows and server builds for that reason. You should avoid using SMB1 unless absolutely necessary, and only on isolated, fully patched systems. Prefer SMB2/SMB3 or other secure file-transfer methods, or upgrade the server if possible. (Microsoft Learn, CISA)

Quick alternatives:

• If the server supports it, let negotiation pick SMB2/SMB3 (omit -m NT1), or explicitly request -m SMB3.
• For mounting via mount.cifs, use -o vers=2.1 or vers=3.0 instead of 1.0. See your distro/Samba docs for exact options. (Red Hat Docs, wiki.archlinux.org)

If you must connect to legacy SMB1 gear, make sure the network is trusted, monitor the host closely, and plan to migrate away from SMB1 as soon as feasible.