Solved Per-host "min protocol" in samba?

[`Orum]

I've recently set our samba server at work to use "server min protocol = SMB2", as some of our Windows clients were using older dialects to communicate. Samba 4.10 (and possibly earlier versions) seem to have some issues with the older standards, and there are security benefits to having this enabled, so I really don't want to remove it. However, we have one thing, a copier, which doesn't support the newer versions of the protocol, and thus it can't scan documents to the network shares unless the server speaks the older dialects.

I've tried to enable this in a similar manner to the way you do more verbose logging for a single host, i.e. (pretend the copier's IP is 1.2.3.4):

In /usr/local/etc/smb4.conf:

[global]
  include = /usr/local/etc/samba/%m.conf
  server min protocol = SMB2
  # ...

% cat /usr/local/etc/samba/1.2.3.4.conf
# copier specific config
[global]
        server min protocol = LANMAN1

...followed by a # smbcontrol all reload-config. But, the copier still cannot negotiate a dialect with samba, as samba always returns a selected index of 0xFF FF (according to wireshark, this is signed and thus equal to -1). Does anyone know how to permit other dialects on a per-host basis?

 

[`Orum]

Nevermind, I'm an idiot. The samba configuration is parsed in order, with later options overriding earlier ones. Thus, the global config (i.e. smb4.conf, not the [global] section) was always overriding whatever I set in the per-host config for the server min protocol.

So I'd say it's best to always put the 'include' option at the end of your [global] section, so you can override whatever smb4.conf options you need to and not the other way around.