Skip to content

Set SMB server settings

When you finish, SMB messages from signed-in users are signed, sessions encrypt whenever the client supports it, and users see only the shares they can open. These settings apply to every SMB share on the cluster.

Before you start

  • A Qumulo cluster whose REST API on port 8000 you can reach from this machine
  • An admin account on the cluster for the connection profile
  • Terraform 1.11 or later

1. Copy the configuration

Save this as main.tf in an empty directory.

terraform {
  required_version = ">= 1.11"
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

provider "qumulo" {
  connection_profiles = [
    {
      name                 = "cluster1"
      endpoint             = "https://cluster.example.com:8000" # <-- Replace with your cluster's REST API endpoint
      username             = "admin"
      password             = "YourClusterPassword123!" # <-- Replace with your admin password
      insecure_skip_verify = true
    },
  ]
}

resource "qumulo_smb_settings" "main" {
  connection_profile = "cluster1"

  session_encryption                  = "PREFERRED"
  signing_required                    = true
  hide_shares_from_unauthorized_users = true
}

Replace the two values marked <-- Replace, and leave the rest as written. Delete insecure_skip_verify if the cluster's certificate is signed by a CA your machine trusts.

2. Match the settings to your clients

  • If every client speaks SMB 3, set session_encryption = "REQUIRED" and supported_dialects = ["SMB2_DIALECT_3_0", "SMB2_DIALECT_3_11"] to turn away unencrypted sessions and older dialects.
  • If older clients cannot sign or encrypt, set session_encryption = "NONE" and signing_required = false.
  • To keep .snapshot directories out of SMB listings, set snapshot_directory_mode = "HIDDEN".
  • To also hide shares from hosts the share permissions deny, set hide_shares_from_unauthorized_hosts = true.

The plan in step 3 shows every setting you changed.

3. Apply

terraform init -upgrade
terraform plan
terraform apply

The plan ends with Plan: 1 to add, 0 to change, 0 to destroy. The apply ends with Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

4. Check the settings

terraform plan

The plan reports No changes. Your infrastructure matches the configuration., which confirms the cluster now holds the values you set.

Next

Put these settings to work in Share directories over SMB, and find SMB3 encryption and signing concepts in Qumulo's documentation. The qumulo_smb_settings reference lists every attribute, Manage several clusters from one configuration applies them across a fleet, and the cluster troubleshooting guide helps if a step fails.