From 8c1d2d60a67c4bab6042e92cf65374d7abca82de Mon Sep 17 00:00:00 2001 From: atx32 Date: Thu, 2 Jul 2026 18:28:37 -0500 Subject: [PATCH 01/10] Add enable-check.sh for nmbd service management This script enables or disables the nmbd service based on the configuration setting. --- samba/rootfs/etc/s6-overlay/scripts/enable-check.sh | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 samba/rootfs/etc/s6-overlay/scripts/enable-check.sh diff --git a/samba/rootfs/etc/s6-overlay/scripts/enable-check.sh b/samba/rootfs/etc/s6-overlay/scripts/enable-check.sh new file mode 100644 index 000000000..5b2c5799b --- /dev/null +++ b/samba/rootfs/etc/s6-overlay/scripts/enable-check.sh @@ -0,0 +1,12 @@ +#!/usr/bin/with-contenv bashio +# shellcheck shell=bash +# ============================================================================== +# Enable/disable nmbd service per config +# ============================================================================== +if bashio::config.true 'netbios'; then + touch /etc/s6-overlay/s6-rc.d/user/contents.d/nmbd + bashio::log.info "Service nmbd enabled" +else + rm -f /etc/s6-overlay/s6-rc.d/user/contents.d/nmbd + bashio::log.info "Service nmbd disabled" +fi From c20bed3b140c2c426f9fd47c13394a02435a4156 Mon Sep 17 00:00:00 2001 From: atx32 Date: Thu, 2 Jul 2026 18:36:27 -0500 Subject: [PATCH 02/10] Modify Samba config to include netbios option --- samba/config.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/samba/config.yaml b/samba/config.yaml index 00bdbc2aa..d9579ee1f 100644 --- a/samba/config.yaml +++ b/samba/config.yaml @@ -23,7 +23,6 @@ options: username: homeassistant password: null workgroup: WORKGROUP - local_master: true enabled_shares: - addons - addon_configs @@ -34,6 +33,8 @@ options: - ssl compatibility_mode: false apple_compatibility_mode: true + netbios: true + local_master: true server_signing: "default" veto_files: - ._* @@ -52,11 +53,12 @@ schema: username: str password: password workgroup: str - local_master: bool enabled_shares: - "match(^(?i:(addons|addon_configs|backup|config|media|share|ssl))$)" compatibility_mode: bool apple_compatibility_mode: bool + netbios: bool + local_master: bool server_signing: list(default|auto|mandatory|disabled) veto_files: - str From a5c51fae76602c9c6c4e4e11eacf51b10506c237 Mon Sep 17 00:00:00 2001 From: atx32 Date: Thu, 2 Jul 2026 18:38:18 -0500 Subject: [PATCH 03/10] Add S6 stage 2 hook for nmbd enable/disable --- samba/Dockerfile | 3 +++ 1 file changed, 3 insertions(+) diff --git a/samba/Dockerfile b/samba/Dockerfile index 63b54d91d..c7cd5390d 100644 --- a/samba/Dockerfile +++ b/samba/Dockerfile @@ -19,3 +19,6 @@ COPY rootfs / HEALTHCHECK --start-period=3s \ CMD smbclient -L '\\localhost' -U '%' -m SMB3 + +ENV \ + S6_STAGE2_HOOK=/etc/s6-overlay/scripts/enable-check.sh From 73d98c6d47ae1a58b1c8635d7d70bc524eab35e7 Mon Sep 17 00:00:00 2001 From: atx32 Date: Thu, 2 Jul 2026 18:42:02 -0500 Subject: [PATCH 04/10] Update Samba translation for local_master and netbios options Added netbios configuration for legacy SMB clients and reworded local_master description. --- samba/translations/en.yaml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/samba/translations/en.yaml b/samba/translations/en.yaml index 7fee4e38d..06a33147c 100644 --- a/samba/translations/en.yaml +++ b/samba/translations/en.yaml @@ -11,9 +11,6 @@ configuration: workgroup: name: Workgroup description: Change WORKGROUP to reflect your network needs. - local_master: - name: Local master - description: Enable to try and become a local master browser on a subnet. enabled_shares: name: >- Enabled Shares - allowed values are: @@ -33,6 +30,15 @@ configuration: Enable Samba configurations to improve interoperability with Apple devices. May cause issues with file systems that do not support xattr such as exFAT. + netbios: + name: Enable NetBIOS over IP + description: >- + Enable NetBIOS over IP for legacy SMB clients (Windows 95/98/ME, Windows NT, + Windows 2000, Windows XP and LanManager clients). Disable to improve security + and performance if you do not have legacy SMB clients. + local_master: + name: Local master + description: When NetBIOS is enabled, try and become a local master browser on a subnet. server_signing: name: Server signing description: >- From cd0875d8473c31a119149bc0b7fd5d891c0a04a2 Mon Sep 17 00:00:00 2001 From: atx32 Date: Thu, 2 Jul 2026 18:44:20 -0500 Subject: [PATCH 05/10] Update Samba documentation for netbios and local_master Reworded the 'local_master' option section and added details about the 'netbios' option, including its purpose and default value. --- samba/DOCS.md | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/samba/DOCS.md b/samba/DOCS.md index 90c95ab85..611c13175 100644 --- a/samba/DOCS.md +++ b/samba/DOCS.md @@ -65,10 +65,6 @@ compatibility_mode: false Change WORKGROUP to reflect your network needs. -### Option: `local_master` (required) - -Enable to try and become a local master browser on a subnet. - ### Option: `username` (required) The username you would like to use to authenticate with the Samba server. @@ -107,6 +103,19 @@ This can cause issues with file systems that do not support xattr such as exFAT. Defaults to `true`. +### Option: `netbios` + +NetBIOS is a legacy network protocol for accessing SMB/CIFS shares. Enable for legacy clients older than Windows Vista (Windows 95/98/ME, Windows NT, +Windows 2000, Windows XP and LanManager), or OS X 10.9 (Mavericks). This setting is enabled by default for compatibility; disable it on modern installations. + +Defaults to `true`. + +### Option: `local_master` + +When NetBIOS is enabled, try and become a local master browser on a subnet. + +Defaults to `true`. + ### Option: `server_signing` Configure the SMB server signing requirement. This option can improve security by requiring message signing, which helps prevent man-in-the-middle attacks. From 8bce084ff19919592bcba3a86f26a8e3ddb882b1 Mon Sep 17 00:00:00 2001 From: atx32 Date: Thu, 2 Jul 2026 22:28:30 -0500 Subject: [PATCH 06/10] Revise Samba configuration in DOCS.md Updated sample configuration to include missing items and reordered some descriptions. --- samba/DOCS.md | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/samba/DOCS.md b/samba/DOCS.md index 611c13175..7947d44e2 100644 --- a/samba/DOCS.md +++ b/samba/DOCS.md @@ -35,10 +35,9 @@ Directory | Description App configuration: ```yaml -workgroup: WORKGROUP -local_master: true username: homeassistant password: YOUR_PASSWORD +workgroup: WORKGROUP enabled_shares: - addons - addon_configs @@ -47,6 +46,17 @@ enabled_shares: - media - share - ssl +compatibility_mode: false +apple_compatibility_mode: true +netbios: true +local_master: true +server_signing: "default" +veto_files: + - ._* + - .DS_Store + - Thumbs.db + - icon? + - .Trashes allow_hosts: - 10.0.0.0/8 - 172.16.0.0/12 @@ -54,17 +64,8 @@ allow_hosts: - 169.254.0.0/16 - fe80::/10 - fc00::/7 -veto_files: - - "._*" - - ".DS_Store" - - Thumbs.db -compatibility_mode: false ``` -### Option: `workgroup` (required) - -Change WORKGROUP to reflect your network needs. - ### Option: `username` (required) The username you would like to use to authenticate with the Samba server. @@ -73,6 +74,10 @@ The username you would like to use to authenticate with the Samba server. The password that goes with the username configured for authentication. +### Option: `workgroup` (required) + +Change WORKGROUP to reflect your network needs. + ### Option: `enabled_shares` (required) List of Samba shares that will be accessible. Any shares removed or commented out of the list will not be accessible. From 5df5e12b6f21613044969c88af9cc25a622d8307 Mon Sep 17 00:00:00 2001 From: atx32 Date: Fri, 3 Jul 2026 15:59:27 +0000 Subject: [PATCH 07/10] Make enable-check.sh executable --- samba/rootfs/etc/s6-overlay/scripts/enable-check.sh | 0 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100644 => 100755 samba/rootfs/etc/s6-overlay/scripts/enable-check.sh diff --git a/samba/rootfs/etc/s6-overlay/scripts/enable-check.sh b/samba/rootfs/etc/s6-overlay/scripts/enable-check.sh old mode 100644 new mode 100755 From 13d5b3b90a656673cec053b00e5611e572a25453 Mon Sep 17 00:00:00 2001 From: atx32 Date: Sat, 11 Jul 2026 15:22:27 -0500 Subject: [PATCH 08/10] Restrict server port to 445 (disabling 139) when netbios is false, and fix line lengths in en.yaml --- samba/rootfs/usr/share/tempio/smb.gtpl | 4 ++++ samba/translations/en.yaml | 10 ++++++---- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/samba/rootfs/usr/share/tempio/smb.gtpl b/samba/rootfs/usr/share/tempio/smb.gtpl index 2a321b5a7..df72fcca1 100644 --- a/samba/rootfs/usr/share/tempio/smb.gtpl +++ b/samba/rootfs/usr/share/tempio/smb.gtpl @@ -32,6 +32,10 @@ vfs objects = catia fruit streams_xattr {{ end }} + {{ if not .netbios }} + smb ports = 445 + {{ end }} + server signing = {{ .server_signing }} kernel oplocks = yes diff --git a/samba/translations/en.yaml b/samba/translations/en.yaml index 06a33147c..43ba9a80d 100644 --- a/samba/translations/en.yaml +++ b/samba/translations/en.yaml @@ -33,12 +33,14 @@ configuration: netbios: name: Enable NetBIOS over IP description: >- - Enable NetBIOS over IP for legacy SMB clients (Windows 95/98/ME, Windows NT, - Windows 2000, Windows XP and LanManager clients). Disable to improve security - and performance if you do not have legacy SMB clients. + Enable NetBIOS over IP for legacy SMB clients (Windows 95/98/ME, Windows + NT, Windows 2000, Windows XP and LanManager clients). Disable to improve + security and performance if you do not have legacy SMB clients. local_master: name: Local master - description: When NetBIOS is enabled, try and become a local master browser on a subnet. + description: >- + When NetBIOS is enabled, try and become a local master browser on a + subnet. server_signing: name: Server signing description: >- From c9517af260455a175372aae4cc8c41806d9bc9f2 Mon Sep 17 00:00:00 2001 From: atx32 Date: Sat, 11 Jul 2026 18:04:28 -0500 Subject: [PATCH 09/10] Update samba/rootfs/etc/s6-overlay/scripts/enable-check.sh Co-authored-by: Stefan Agner --- samba/rootfs/etc/s6-overlay/scripts/enable-check.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba/rootfs/etc/s6-overlay/scripts/enable-check.sh b/samba/rootfs/etc/s6-overlay/scripts/enable-check.sh index 5b2c5799b..4643c916e 100755 --- a/samba/rootfs/etc/s6-overlay/scripts/enable-check.sh +++ b/samba/rootfs/etc/s6-overlay/scripts/enable-check.sh @@ -1,4 +1,4 @@ -#!/usr/bin/with-contenv bashio +#!/command/with-contenv bashio # shellcheck shell=bash # ============================================================================== # Enable/disable nmbd service per config From 29a784bc533a3e445841958339222ea09f40955e Mon Sep 17 00:00:00 2001 From: atx32 Date: Sun, 12 Jul 2026 10:18:14 -0500 Subject: [PATCH 10/10] Bump version to 12.8.0 and update changelog --- samba/CHANGELOG.md | 3 +++ samba/config.yaml | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/samba/CHANGELOG.md b/samba/CHANGELOG.md index dadaaf19d..0cf6c091d 100644 --- a/samba/CHANGELOG.md +++ b/samba/CHANGELOG.md @@ -1,5 +1,8 @@ # Changelog +## 12.8.0 +- Add configuration option to disable NetBIOS. When disabled, the nmbd service is not started and only port 445 is allowed (port 139 is blocked.) + ## 12.7.1 - Enabled kernel oplocks in smb.conf to ensure changes made to files on disk are available immediately via SMBD. This covers all shares except backup, and media as the contents shouldn't be changed by the server once they're written in those shares. diff --git a/samba/config.yaml b/samba/config.yaml index d9579ee1f..e716065da 100644 --- a/samba/config.yaml +++ b/samba/config.yaml @@ -1,5 +1,5 @@ --- -version: 12.7.1 +version: 12.8.0 slug: samba name: Samba share description: Expose Home Assistant folders with SMB/CIFS