Samba: Add option to disable NetBIOS (nmbd)

samba/CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## 12.8.0
+- Add configuration option to disable NetBIOS. When disabled, the nmbd service is not started and only port 445 is allowed (port 139 is blocked.)
+
 ## 12.7.1
 
 - Enabled kernel oplocks in smb.conf to ensure changes made to files on disk are available immediately via SMBD. This covers all shares except backup, and media as the contents shouldn't be changed by the server once they're written in those shares.

samba/DOCS.md

@@ -35,10 +35,9 @@ Directory | Description
 App configuration:
 
 ```yaml
-workgroup: WORKGROUP
-local_master: true
 username: homeassistant
 password: YOUR_PASSWORD
+workgroup: WORKGROUP
 enabled_shares:
   - addons
   - addon_configs
@@ -47,28 +46,26 @@ enabled_shares:
   - media
   - share
   - ssl
+compatibility_mode: false
+apple_compatibility_mode: true
+netbios: true
+local_master: true
+server_signing: "default"
+veto_files:
+  - ._*
+  - .DS_Store
+  - Thumbs.db
+  - icon?
+  - .Trashes
 allow_hosts:
   - 10.0.0.0/8
   - 172.16.0.0/12
   - 192.168.0.0/16
   - 169.254.0.0/16
   - fe80::/10
   - fc00::/7
-veto_files:
-  - "._*"
-  - ".DS_Store"
-  - Thumbs.db
-compatibility_mode: false
 ```
 
-### Option: `workgroup` (required)
-
-Change WORKGROUP to reflect your network needs.
-
-### Option: `local_master` (required)
-
-Enable to try and become a local master browser on a subnet.
-
 ### Option: `username` (required)
 
 The username you would like to use to authenticate with the Samba server.
@@ -77,6 +74,10 @@ The username you would like to use to authenticate with the Samba server.
 
 The password that goes with the username configured for authentication.
 
+### Option: `workgroup` (required)
+
+Change WORKGROUP to reflect your network needs.
+
 ### Option: `enabled_shares` (required)
 
 List of Samba shares that will be accessible. Any shares removed or commented out of the list will not be accessible.
@@ -107,6 +108,19 @@ This can cause issues with file systems that do not support xattr such as exFAT.
 
 Defaults to `true`.
 
+### Option: `netbios`
+
+NetBIOS is a legacy network protocol for accessing SMB/CIFS shares. Enable for legacy clients older than Windows Vista (Windows 95/98/ME, Windows NT,
+Windows 2000, Windows XP and LanManager), or OS X 10.9 (Mavericks). This setting is enabled by default for compatibility; disable it on modern installations.
+
+Defaults to `true`.
+
+### Option: `local_master`
+
+When NetBIOS is enabled, try and become a local master browser on a subnet.
+
+Defaults to `true`.
+
 ### Option: `server_signing`
 
 Configure the SMB server signing requirement. This option can improve security by requiring message signing, which helps prevent man-in-the-middle attacks.

samba/Dockerfile

@@ -19,3 +19,6 @@ COPY rootfs /
 
 HEALTHCHECK --start-period=3s \
     CMD smbclient -L '\\localhost' -U '%' -m SMB3
+
+ENV \
+    S6_STAGE2_HOOK=/etc/s6-overlay/scripts/enable-check.sh

samba/config.yaml

@@ -1,5 +1,5 @@
 ---
-version: 12.7.1
+version: 12.8.0
 slug: samba
 name: Samba share
 description: Expose Home Assistant folders with SMB/CIFS
@@ -23,7 +23,6 @@ options:
   username: homeassistant
   password: null
   workgroup: WORKGROUP
-  local_master: true
   enabled_shares:
     - addons
     - addon_configs
@@ -34,6 +33,8 @@ options:
     - ssl
   compatibility_mode: false
   apple_compatibility_mode: true
+  netbios: true
+  local_master: true
   server_signing: "default"
   veto_files:
     - ._*
@@ -52,11 +53,12 @@ schema:
   username: str
   password: password
   workgroup: str
-  local_master: bool
   enabled_shares:
     - "match(^(?i:(addons|addon_configs|backup|config|media|share|ssl))$)"
   compatibility_mode: bool
   apple_compatibility_mode: bool
+  netbios: bool
+  local_master: bool
   server_signing: list(default|auto|mandatory|disabled)
   veto_files:
     - str

samba/rootfs/etc/s6-overlay/scripts/enable-check.sh

@@ -0,0 +1,12 @@
+#!/command/with-contenv bashio
+# shellcheck shell=bash
+# ==============================================================================
+# Enable/disable nmbd service per config
+# ==============================================================================
+if bashio::config.true 'netbios'; then
+    touch /etc/s6-overlay/s6-rc.d/user/contents.d/nmbd
+    bashio::log.info "Service nmbd enabled"
+else
+    rm -f /etc/s6-overlay/s6-rc.d/user/contents.d/nmbd
+    bashio::log.info "Service nmbd disabled"
+fi

samba/rootfs/usr/share/tempio/smb.gtpl

@@ -32,6 +32,10 @@
    vfs objects = catia fruit streams_xattr
    {{ end }}
 
+   {{ if not .netbios }}
+   smb ports = 445
+   {{ end }}
+
    server signing = {{ .server_signing }}
 
    kernel oplocks = yes

samba/translations/en.yaml

@@ -11,9 +11,6 @@ configuration:
   workgroup:
     name: Workgroup
     description: Change WORKGROUP to reflect your network needs.
-  local_master:
-    name: Local master
-    description: Enable to try and become a local master browser on a subnet.
   enabled_shares:
     name: >-
       Enabled Shares - allowed values are:
@@ -33,6 +30,17 @@ configuration:
       Enable Samba configurations to improve interoperability with Apple
       devices. May cause issues with file systems that do not support xattr
       such as exFAT.
+  netbios:
+    name: Enable NetBIOS over IP
+    description: >-
+      Enable NetBIOS over IP for legacy SMB clients (Windows 95/98/ME, Windows
+      NT, Windows 2000, Windows XP and LanManager clients). Disable to improve
+      security and performance if you do not have legacy SMB clients.
+  local_master:
+    name: Local master
+    description: >-
+      When NetBIOS is enabled, try and become a local master browser on a
+      subnet.
   server_signing:
     name: Server signing
     description: >-