Ricoh scanning smbv3 woes

[tonerhead]

I know how to set up scan to folder and everything, been doing it forever. I do have one case right now that is a stumper. It is at a university. Very tight security. They are in process of setting up new scan folder and we are in bid process of placing a new copier, (Ricoh IM350f). I have been given the path, username, and password and have verified everything is valid. However it fails everytime. I can use the network browse on the copier and I log in at the server on the copier. From there I can browse to the folder and I think I am home free. The second I scan, it fails. The error is verification error in scanner log. I contacted network security at the university. They checked security logs on the server and find that username/password from the copier to the server is not encrypted. This is a key factor in SMB3. All of settings in Ricoh are correct, firmware is current, etc.

Here's the kicker. Another dept has a Kyocera, I remoted into it and place the same settings into it as the Ricoh. It works right out of the box, no changes needed. The Kyocera is 2-3 years old even.

So I contact Ricoh. Send debug logs, smc, etc. They come back with instructions to telnet into the copier and set smb to user security level 3. I remember having to do this years ago when we were all migrating from smb1 to smb2. Well that didn't work either. In the Ricoh you have the option of smb2/3. I want pure smb3. I am guessing it is trying smb2 first then trying smb3 if smb2 fails. The server shuts it down and their IT says it is not using smb3. I agree with them.

I need pure smb3. Any help appreciated, we are in a time crunch.

[bsm2]

Could be domain name issue

did you enter the domain name in network settings?

Or you may have to add it to the username

[tonerhead]

Domain name is entered into network settings. Thanks for reply.

[qbert69]

Using port 445 or 139? Port 445 should be the correct port. Port 139 is CIFS & deprecated. I remember having to change the port via telnet on a savin...total joke!!!

Sent from my SM-N950U1 using Tapatalk

[tonerhead]

Yes, port 445

[tsbservice]

Interesting, Konicas also don't have this SMBv3 setting only. I guess in the future that may be problem for us also.

[tonerhead]

Well we lost this round, they are going with another Kyocera. The entire campus is scan to email right now which is working fine on the Ricohs. However if more departments decide to scan to folder in the future, the Ricohs might be dropping like dominoes. If anyone has any other thoughts, please post.

[rthonpm]

One of the features of SMB3 is encryption in transit. For Windows shares, it's a check in the box in share settings using Server Manager. Since only SMB3 clients can connect to a share when encryption is turned on, it will force the MFP to only use SMB3 to connect. Our close to ancient office MP 171 which received the SMB3 firmware upgrades works without issues to shares on both Windows servers and a NAS with SMB encryption turned on. Checking with PowerShell for what version of SMB is being used to connect to a share, the devices sohws as connecting with SMB3.

[tonerhead]

It should work especially if a 171 works. The college is saying it is sending username/password in cleartext. Server will not allow that. I have always thought SMB went as follows. SMB1 wide open, SMB2 username/password, SMB3 username/password, file are encrypted. Doesn't make sense that a Kyocera works and Ricoh doesn't

[rthonpm]

It should work especially if a 171 works. The college is saying it is sending username/password in cleartext. Server will not allow that. I have always thought SMB went as follows. SMB1 wide open, SMB2 username/password, SMB3 username/password, file are encrypted. Doesn't make sense that a Kyocera works and Ricoh doesn't

Not quite: all three versions are able to use authentication. SMB2 hardened the requirements for it by needing to specify who can access the share at creation. SMB3 encryption isn't enabled by default. It can be done at the server or share level. Is it possible that the customer's IT doesn't have encryption turned on for the share(s) or that it's set to only encrypt when using an SMB3 connection? If encryption is on and enforced, the only thing that can connect is an SMB3 client.


Sent from my BlackBerry using Tapatalk