Server Message Block (SMB)/Common Internet File System (CIFS)

The Server Message Block (SMB), later renamed and commonly referred to as the Common Internet File System (CIFS), is a file-based protocol that uses the client/server communication architecture. Regarding the naming of the protocol, in this book, SMB and CIFS are used interchangeably. Although there are more details and separation in the components, this discussion is not intended to be a deep dive but rather a high-level overview. The SMB is used to share files, printers, and serial ports among users in a network. Initially developed by Barry Feigenbaum at IBM in 1983, it was later adopted by Microsoft and became a component of the LAN Manager. Microsoft continued to develop the protocol, and it evolved through multiple versions:

• SMB/CIFX/SMB1: The SMB/CIFS protocol was created to use NetBIOS over TCP/IP (NBT) communication. Starting with Microsoft Windows 2000 Server operating system, the communication has been changed to use TCP as a transport utilizing TCP port 445. Used natively in Microsoft Windows 2003. In 1996, Microsoft renamed the protocol to Common Internet File System after Sun Microsystems announced the WebNFS initiative.
• SMB 2.0: Released in 2006 and supported by Windows 2008 Server and the Windows Vista. Improved the communication by decreasing the handshake messages. Supports symbolic links and the HMAC SHA-256 hashing algorithm for signing. SMB 2.0 uses 32-bit and 64-bit-wide storage fields, and 128 bits for file handles. This allowed for improved performance when copying large files. Fully supported in Samba 3.6.
• SMB 2.1: Performance enhancements.
• SMB 3.0: Introduced the SMB Direct Protocol, SMB Multichannel, and SMB Transparent Failover. These features provided better support for data centers.
• SMB 3.1.1: Released in Windows Server 2016 and Windows 10. Requires secure negotiation and supports AES-128 encryption.

The SMB/CIFS protocol is supported on the Microsoft Windows Server and desktop operating systems, but it can also be used with Linux/Unix and the Apple operating systems. This can be achieved by using the Samba software. The Samba was developed in 1992 by Andrew Tridgell. Here are some of the services and protocols supported:

• NetBIOS over TCP/IP
• SMB/CIFS
• DCE/RPC
• WINS
• Security Account Manager
• NTLM
• AD logon with Kerberos and LDAP

As already mentioned, the CIFS uses the client/server architecture, but in fact it consists of three separate entities:

• CIFS client: This piece is on the end-user machine and is capable of communicating with the CIFS server using the CIFS protocol. It is like a driver on your operating system; it has all the needed functionality to communicate using this protocol. The requests to the CIFS server always originate from the CIFS client.
• CIFS Server: This entity provides the CIFS functionality. As the CIFS protocol provides access to shared file systems, but also supports the communications between processes on different systems, the CIFS server includes multiple subcomponents and subsystems responsible for the needed functionality. Such components and systems are the SMB Trans, SMB Trans2, and NT Trans, forming the transactions-processing subsystem. There are also the RPC and the user authentication pieces, as well as the Remote Administration Protocol (RAP) and the Distributed File System (DFS).
• CIFS Application: This entity triggers the communication between the CIFS client and the server. The CIFS client and server are the pieces that can communicate with each other, using the CIFS protocol. The application is the piece that actually utilizes the functionality offered by the VIFS server. It cannot natively communicate with the server; that’s why it uses the CIFS client.