How to Enable SMB1-NT1 per Client IP in Samba - Use config file Instead of include.md

How to Enable SMB1/NT1 per Client IP in Samba — Use config file Instead of include

Starting with Samba 4.20, administrators have reported that using include = /etc/samba/smb.conf.%I does not reliably apply settings like server min protocol = NT1. The reason is that protocol negotiation happens at the very start of the connection, before the include file is loaded. As a result, even if you specify NT1 in the per-IP include file, the server has already locked onto the global default (SMB2_02 or higher), and the client will fail with “No protocol supported”.

This article explains why this happens and how to fix it using config file = %I.

---

Why include Fails for server min protocol

• include files are processed after the initial configuration has already been loaded.
• The protocol negotiation phase occurs immediately when the client connects. At this point, Samba has not yet read the per-IP include file.
• Therefore, critical parameters like server min protocol or ntlm auth are not in effect during the handshake.

---

The Solution: config file = %I

Unlike include, the config file directive switches the entire configuration to the specified file before negotiation starts. This ensures that per-IP settings apply from the very first packet.

Step 1: Split out common settings

Move shared settings and share definitions into a common file, e.g.:

/etc/samba/smb.conf.common

Step 2: Main smb.conf with config file

In your main config:

[global]
config file = /etc/samba/smb.conf.%I
include = /etc/samba/smb.conf.common

• If /etc/samba/smb.conf.%I does not exist for a given client IP, Samba ignores it and continues with the rest of the config.
• %I expands to the client’s IP address.

Step 3: Per-IP configuration file

Example for client 172.19.37.72:

# /etc/samba/smb.conf.172.19.37.72
[global]
server min protocol = NT1
ntlm auth = yes
lanman auth = no

include = /etc/samba/smb.conf.common

Step 4: Validate and restart

testparm -s /etc/samba/smb.conf.172.19.37.72
systemctl restart smbd
smbclient -L //SERVER -U user -m NT1

---

Best Practices

• Keep per-IP files minimal: only override what differs from the default.

• Always include the common config to avoid duplication and errors.

• Secure SMB1/NTLMv1 usage:

  • Restrict access to known client IPs (hosts allow / firewall rules).
  • Keep shares read-only whenever possible.
  • Isolate legacy instances (e.g., bind to a separate interface/IP).
  • Plan for deprecation—SMB1/NTLMv1 are inherently insecure.

---

Summary

• include = %I is too late for protocol negotiation.
• Use config file = %I instead to ensure per-client IP settings like server min protocol = NT1 are applied during the initial handshake.
• Restrict and isolate any SMB1 usage to minimize security risks.