Overview: When does the signature apply and what problems could there be?

You now know what SMB signing is and how best to set it up. What’s missing now? A little more understanding of what these settings actually mean and possible problems. Not every improvement runs smoothly right from the start. The question is what is the security of private photos and sensitive data worth to you in terms of losses.

Overview: SMB Signing – Briefly summarized

The table illustrates how the SMB signing is created depending on the settings on the client and server side. Two parameters are decisive:

• RequireSecuritySignature:
  If this value is set to 1, the respective page requires a signed connection. Without a valid signature, the connection is rejected.
• EnableSecuritySignature:
  If this value is set to 1, signing is offered. The page signs the communication if the other side also supports this. This setting is no longer used in the latest SMBv3 version. SMBv3 has automatically activated the signature and only limits the setting to forcing the signature.

The behavior in detail:

• At least one side with “Require = 1” forces a signed connection. If no signing is offered on the other side, the connection is blocked.
• Both pages with “Enable = 1” allow signing, but do not require it. In this case, the connection is signed if possible.
• If both sides have set “Require = 0” and “Enable = 0”, no signing takes place. Communication remains unprotected.

Where SMB signing reaches its limits – performance & practical problems

Of course, SMB signing does not only bring advantages. Some points need to be considered:

• Performance overhead:
  Every single SMB message is checked by the signature. This means: more CPU load, more network traffic, more time required. In small networks, this is hardly noticeable – but in large infrastructures with high data volumes, the loss of performance can be noticeable. This load is particularly noticeable under Windows Server 2016 and 2019 in conjunction with SMB 2. From Server 2022 and SMB 3, the additional load is negligible.
• Compatibility issues:
  Not every device is compatible with SMB Signing by default. Older operating systems such as Windows 9x or Linux systems with Samba 3.0.2 or older, outdated hardware and printer models prior to 2013 do not support this function. On other systems such as Windows 2000, SMB Signing must be activated, which may mean that SMB Signing is not supported due to a lack of configuration.
• Complexity of implementation:
  In networks with different operating systems, servers and end devices, setting up SMB requires a certain amount of technical understanding. During implementation, it must be configured correctly and then tested to prevent downtime due to interrupted communication.
• Troubleshooting and diagnostics:
  Every SMB message must have a valid signature. Small configuration errors or network problems are therefore less likely to be “forgiven”. Diagnostic tools and precise logging are essential in order to quickly identify and rectify sources of error.

Conclusion

SMB signing is not a detail you should ignore. The effort compared to the benefit is minimal. So be proactive and protect yourself before an attacker sees your missing signature as an invitation. If you are unsure, take a look at our guide to the settings or find out again here what exactly SMB Signing does.