SambaCry [how to be protected?]

[John_n4s]

Could anyone tell me if its possible to update samba on a Freenas 9.3 clean installation that runs samba version 4.1.13 ?
If yes, how?
If no, what is my best option to be protected for the SambaCry exploit?

Context on SambaCry: http://thehackernews.com/2017/06/linux-samba-vulnerability.html

 

[danb35]

Update to 9.10.2-U4 or later.

 

[John_n4s]

Update to 9.10.2-U4 or later.

Thanks for the quick reply!
I was afraid this would be mentioned though... holding back upgrading to 9.10 because of all my current jail configurations and so forth..
Hopefully there is any kind of way to still be safe on 9.3 ..

 

[danb35]

Your current jails will continue to work just fine under 9.10, though I believe you'll no longer be able to do things like updating software packages in them.

 

[DrKK]

Hopefully there is any kind of way to still be safe on 9.3 ..

If by "safe" you mean safe from the SMB exploit, then no, not really. This would require hacking the appliances system files, which is all sorts of unrecommended.

As danb35 says, if you update to 9.10-U5 (which is what I suggest you do), then your jails will, at that point, be frozen in time. YOu will still be able to use them, as you did before, but ultimately they are now frozen from being updated. I think it is worth doing. You'll be moving to a newer, and better, FreeBSD system, and you'll be on the current widely community supported FreeNAS.

Are your jails plugins, or custom jails? What are you running in the jails?

 

[John_n4s]

If by "safe" you mean safe from the SMB exploit, then no, not really. This would require hacking the appliances system files, which is all sorts of unrecommended.

As danb35 says, if you update to 9.10-U5 (which is what I suggest you do), then your jails will, at that point, be frozen in time. YOu will still be able to use them, as you did before, but ultimately they are now frozen from being updated. I think it is worth doing. You'll be moving to a newer, and better, FreeBSD system, and you'll be on the current widely community supported FreeNAS.

Are your jails plugins, or custom jails? What are you running in the jails?

Thanks for the reply.
Well there are 2:
- virtualbox (never modified - no mind to be frozen tbh)
- transmission (customized by installing openvpn, firewall rules and flexget inside of it - often updating and running pkg updates)

I think the last would be an issue..

 

[danb35]

Actually, virtualbox will be a problem, as it simply won't work on 9.10.2.

 

[John_n4s]

Actually, virtualbox will be a problem, as it simply won't work on 9.10.2.

Ouch.. for now i arranged authentication on all of the shares and killed off nt pipe mode in the global samba configuration.
Seems to be the most I can do for now without ruining my entire custom setup..
Thanks for all the replies so far!