portfolio site templates

fileServersNG

The fileServersNG module replaces the file servers subsystem that ships as part of the standard Alfresco Content Management System with a new subsystem that is based on the JFileServer file server code, enabling support for the newer SMB v2 and SMB v3 protocols, and adding new features.

SMB Protocols

The original SMB v1 protocol has been around for over 30 years, it was designed for a different world of smaller isolated networks rather than the interconnected world of today where networks are under constant attack. The SMB v1 protocol is not considered to be safe as it allows man in the middle and security downgrade attacks that have been used many times in real world attacks. Recent Windows updates have not installed the SMB v1 protocol. SMB v1 should be disabled for good, leaving SMB v1 available for older clients is a big security hole that can be exploited.

The SMB v2 and v3 protocols solve many of the issues that SMB v1 has. The SMB v2 protocol is more effecient on the network allowing much larger amounts of data to be transferred in a single request, whereas SMB v1 tends to use a maximum of around 64Kb in most cases, SMB v2 on Windows 10 will tend to use 2Mb. SMB v2 also uses a sliding window of requests, this helps with network latency as it is more like a streaming protocol whereas SMB v1 usually sends a request and waits for the response before sending the next request. SMB v2 also uses compounding of requests so multiple requests are sent in one packet, SMB v1 also has compounding but does not use it very often.

The SMB v2 and v3 protocols prevent security downgrade attacks by adding pre-authentication integrity checks and using secure negotiation which the client checks after successfully authenticating with the server. SMB v2 adds more effecient packet signing. SMB v3 adds full encryption support using effecient AES encryption, that is usually implemented in modern CPU hardware.

The fileServersNG Solution

fileServersNG is an Alfresco Module Package (AMP) that adds SMB v2 and SMB v3 support to Alfresco so you can continue to use shared drives to upload and edit files within Alfresco, available for Alfresco versions 5.2 and 6.x.

As well as the SMB enhancements fileServersNG also has many updates to authentication to allow it to use the latest versions of Active Directory when using Kerberos authentication to the file server. This includes the latest high strength AES 128-bit and AES 256-bit modes.

The latest fileServersNG add-on for Alfresco 6.1 and Alfresco 5.2 include a new feature to allow access to previous file versions for files that have the Versionable aspect. To access the previous file versions use the Windows Explorer right click Properties menu item and select the Previous Versions tab.

Mobirise
Configuration

The fileServersNG subsystem is configured in the same way as the original subsystem using configuration properties in the alfresco-global.properties file. The fileServersNG subsystem uses the 'smb' prefix for the SMB properties and 'ftpng' for the FTP properties so that they do not clash with the existing file servers subsystem properties.

The following table lists the available configuration properties :-

PropertyDescription
smb.enabledEnable the fileServersNG SMB file server, true or false
ftpng.enabledEnable the fileServersNG FTP file server, true or false
smb.dialectsList of enabled SMB dialects that the server will negotiate with the client. SMB1, SMB2 and or SMB3
smb.kerberos.realmKerberos realm, enables Kerberos authentication if set
smb.kerberos.stripUsernameSuffixStrips the suffix from the Kerberos authenticated user name that includes the realm, when matching to the Alfresco user account, true or false
smb.kerberos.loginEntryNameEntry to use within the Java login configuration, default FileServerSMB
smb.kerberos.debugEnable Kerberos authentication debug output, true or false
smb.kerberos.configPath to the Kerberos configuration file, eg. /kerberos/alfresco_krb5.conf
smb.login.configPath to the Java login configuration file, eg. /kerberos/alfresco_login.config
smb.disableNTLMDisable NTLM authentication, true or false
smb.disallowNTLMv1Do not allow the weaker NTLM v1 authentication, true or false
smb.useSPNEGOUse SPNEGO within the authentication phase, true or false. This will be forced to true when SMB2 and/or SMB3 dialects are enabled.
smb.maxPacketSizeMaximum packet size to negotiate with the client when using SMB2 or SMB3. Can be specified as 'n' bytes, 'nK' kilobytes or 'nM' megabytes. The default setting is 2M.
smb.requireSigningRequire the client to use packet signing for SMB2
smb.enablePostCloseEnable the experimental feature available in fileServersNG-v61 and fileServersNG-v5 that allows the file close response to be sent by the protocol layer then perform file close processing within Alfresco. This can speed up the response in particular for versioned files where it can take some time to check if the file is actually a new version. Value true or false. 
smb.sessionDebugEnable SMB debug output, see the Wiki document for the full list of debug levels
Running fileServersNG

There are Docker images available with Alfresco 5.2, 6.0 and 6.1 installations with the fileServersNG file servers subsystem deployed. For details of how to get the Docker images and configure them see the FileSys.Org Wiki.

Details of how to build the various fileServersNG AMPs are also available on the FileSys.Org Wiki.

Pre-built AMPs are available for Alfresco 5.2, Alfresco 6.0 and Alfresco 6.1.

Licencing

To enable the JFileServer Enterprise add-on within the fileServersNG file server subsystem a licence key is required. The fileServersNG Docker images contain a free to use 25 client licence. Request the free to use licence key for a standalone Alfresco installation by emailing info@filesys.org.

Licence keys are sold depending on the number of clients that will connect to the file server. The initial licence fee includes 12 months email support. The price list is shown below, for higher key sizes email info@filesys.org.
Key Size Price (US$) Support (Year 2 onwards, US$)
50899179
1001499299
2002599519
5004499899
100064991299

© Copyright 2018-2019 FileSys.Org - All Rights Reserved