samba - Oct 2019 - After configured server signing, file transfer speed is very slow

Hi Team,

After configured server signing as mandatory in smb.conf, file transfer
speed has slow down.
Almost 90% speed has reducing. Kindly do the needful.

Please find the below configuration:
[Global]
available= yes
restrict anonymous= 0
server string= Test
Workgroup= GNANA
netbios name= Test
realm= GNANA.COM <http://VIGNESH.COM>
password server= 192.168.1.14, *
idmap backend= tdb
idmap uid= 5000-9999999
idmap gid= 5000-9999999
idmap config GNANA : backend= rid
idmap config GNANA : range= 10000000-19999999
security= ADS
name resolve order= wins host bcast lmhosts
client use spnego= yes
dns proxy= no
winbind use default domain= no
winbind nested groups= yes
inherit acls= yes
winbind enum users= yes
winbind enum groups= yes
winbind separator= \\
winbind cache time= 300
winbind offline logon= true
template shell= /bin/sh
kerberos method= secrets and keytab
map to guest= Bad User
host msdfs= yes
strict allocate= no
encrypt passwords= yes
passdb backend= smbpasswd
printcap name= lpstat
printable= no
load printers= yes
ntlm auth= Yes
server signing= mandatory

Thanks,
Vignesh.

On 29/10/2019 06:55, VigneshDhanraj G wrote:
> Hi Team,
>
> After configured server signing as mandatory in smb.conf, file 
> transfer speed has slow down.
> Almost 90% speed has reducing. Kindly do the needful.
>
Okay, done, here is your corrected smb.conf with all the default and 
incorrect lines removed:

[Global]
Workgroup= GNANA
netbios name= Test
server string= Test
realm= GNANA.COM
security= ADS
idmap config * : idmap backend = tdb
idmap config * : range = 5000-9999999
idmap config GNANA : backend = rid
idmap config GNANA : range= 10000000-19999999
dns proxy= no
inherit acls= yes
winbind separator= \\
winbind offline logon= true
template shell= /bin/sh
kerberos method= secrets and keytab
map to guest= Bad User
printcap name= lpstat
ntlm auth= Yes
server signing= mandatory

If you want to discuss this further, please take it to the correct 
place, the samba mailing list, not samba-technical.

Rowland

Hi team,

I want to configure server signing as mandatory without reducing speed, but
you have mentioned that remove the server signing.
Can you please explain why 90% speed is reducing after configured server
signing as mandatory?

Kindly do the needful,

Thanks,
Vignesh.


On Tue, Oct 29, 2019 at 12:25 PM VigneshDhanraj G <
vigneshdhanraj.g at gmail.com> wrote:
> Hi Team,
>
> After configured server signing as mandatory in smb.conf, file transfer
> speed has slow down.
> Almost 90% speed has reducing. Kindly do the needful.
>
> Please find the below configuration:
> [Global]
> available= yes
> restrict anonymous= 0
> server string= Test
> Workgroup= GNANA
> netbios name= Test
> realm= GNANA.COM <http://VIGNESH.COM>
> password server= 192.168.1.14, *
> idmap backend= tdb
> idmap uid= 5000-9999999
> idmap gid= 5000-9999999
> idmap config GNANA : backend= rid
> idmap config GNANA : range= 10000000-19999999
> security= ADS
> name resolve order= wins host bcast lmhosts
> client use spnego= yes
> dns proxy= no
> winbind use default domain= no
> winbind nested groups= yes
> inherit acls= yes
> winbind enum users= yes
> winbind enum groups= yes
> winbind separator= \\
> winbind cache time= 300
> winbind offline logon= true
> template shell= /bin/sh
> kerberos method= secrets and keytab
> map to guest= Bad User
> host msdfs= yes
> strict allocate= no
> encrypt passwords= yes
> passdb backend= smbpasswd
> printcap name= lpstat
> printable= no
> load printers= yes
> ntlm auth= Yes
> server signing= mandatory
>
> Thanks,
> Vignesh.
>

On Tue, Oct 29, 2019 at 04:46:21PM +0530, VigneshDhanraj G via samba
wrote:
> Hi team,
> 
> I want to configure server signing as mandatory without reducing speed, but
> you have mentioned that remove the server signing.
> Can you please explain why 90% speed is reducing after configured server
> signing as mandatory?
Completely depends on your platform and OS. Are you using hardware
assist for the crypto ? Samba can do so on modern Intel processors
with native AES instructions.

In my testing signing is slower than encryption (but only when using
SMB3.1.1 GCM e.g. to Windows or Andreas's Samba GCM branch). With
Andreas's GCM SMB3.1.1 in Samba, I find there to be no need for
signing as encryption is faster.

On Tue, Oct 29, 2019 at 1:56 AM VigneshDhanraj G via samba-technical
<samba-technical at lists.samba.org> wrote:
>
> Hi Team,
>
> After configured server signing as mandatory in smb.conf, file transfer
> speed has slow down.
> Almost 90% speed has reducing. Kindly do the needful.
>
> Please find the below configuration:
> [Global]
> available= yes
> restrict anonymous= 0
> server string= Test
> Workgroup= GNANA
> netbios name= Test
> realm= GNANA.COM <http://VIGNESH.COM>
> password server= 192.168.1.14, *
> idmap backend= tdb
> idmap uid= 5000-9999999
> idmap gid= 5000-9999999
> idmap config GNANA : backend= rid
> idmap config GNANA : range= 10000000-19999999
> security= ADS
> name resolve order= wins host bcast lmhosts
> client use spnego= yes
> dns proxy= no
> winbind use default domain= no
> winbind nested groups= yes
> inherit acls= yes
> winbind enum users= yes
> winbind enum groups= yes
> winbind separator= \\
> winbind cache time= 300
> winbind offline logon= true
> template shell= /bin/sh
> kerberos method= secrets and keytab
> map to guest= Bad User
> host msdfs= yes
> strict allocate= no
> encrypt passwords= yes
> passdb backend= smbpasswd
> printcap name= lpstat
> printable= no
> load printers= yes
> ntlm auth= Yes
> server signing= mandatory
>
> Thanks,
> Vignesh.


-- 
Thanks,

Steve