2

I have a network with several servers and I've disabled SMBv1 on every server except one because an office printer/scanner is used to scan documents to a shared folder over SMB. The printer is only about 6 years old but it doesn't support SMB v2 or 3 and the vendor confirms that there is no firmware update that enables this. Naturally I don't have v1 exposed to the wider Internet but if a machine were compromised on the LAN the server is vulnerable to various exploits while v1 is enabled.

Is there a mechanism that would make it possible to allow SMB v1 traffic only from this decrepit printer while still allowing v2/3 SMB traffic to the server? My understanding is that all version of SMB run on the same port. I have a sonicwall firewall/router and DLink switches on the network if that is helpful.

Barring this, I'm looking into alternatives such as moving the scan files into place via FTP (yes, the printer doesn't support sftp) or decommissioning the hardware.

  • 1
    Can you add a network card to this server ? (if so, doing so and doing a separated subnet for this server and the printer, you should be able to allow smbV1 only on the networks card linked to the printer, limiting the surface of exposition) – Tensibai May 15 '17 at 16:12
  • Interesting idea. I believe I can do that, @Tensibai. However, if I could that I think I could also do with by VLAN, but unless I'm mistaken I still have the problem that SMB v2/3 (which I need) also run over port 445. I can't find out how to keep v2/3 and only serve v1 to this device. – Duane Gran May 15 '17 at 18:15
  • IIRC you can tweak the protocol by interface (hence why I said another card) in the registry also (I cannot confirm right now the feasibility, sorry) – Tensibai May 15 '17 at 18:18
  • 2
    Basic option being, replace the printer, or add a recent cheap print server linksys/dlink) and connect it with LPT to the printer – Tensibai May 15 '17 at 18:24
  • 1
    Just to close the loop on this, eventually we determined the most direct way to solve this was to switch to scanning by FTP instead of SMB. – Duane Gran May 23 '17 at 17:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.