SMB Support

[elmocito]

Any plans to have SMB support? Would be awesome 🤩

[bifrost0x]

Thank you for contributing and for sharing this feature idea! I'll take a detailed look at it today. If it fits the project and is feasible, I'll try to implement it and will keep you updated here.

[elmocito]

I have tons of more ideas your project seems the only one that has the potential to get close to FileRise. 💪

[bifrost0x]

Quick update as promised: SMB is currently among the top five features on the roadmap. I already prepared the File Manager for it as part of the recent major rework. However, the actual SMB integration is a substantial change involving security-sensitive areas such as authentication, credential handling, network access, and user isolation. I do not want to rush it. I need to design and secure it carefully so that it does not put WebSSH or existing installations at risk. SMB is definitely on the radar, but a safe and reliable implementation will take some time. But you can be sure that it will come soon. :-)

[elmocito]

My man! 🤝💪

[bifrost0x]

Update: SMB support has now landed on main via #140 and is ready for testing 🎉

It is opt-in and remains disabled by default. To enable it, set:

SMB_ENABLED=true
SMB_ALLOWED_TARGETS=nas.example,10.0.0.8

Then restart WebSSH and open the File Manager to connect an SMB share. Each allowed target must be an exact hostname or IP address; ports, paths, and wildcards are rejected.

The implementation deliberately requires TCP 445, SMB 3.1.1, signing, encryption, and secure negotiation. Passwords are never saved. Non-secret share details such as name, host, share, domain, and username can be stored per user.

If you can, please test it with a non-production share or a current backup, especially:

• connecting and reconnecting to saved shares
• creating, editing, renaming, and deleting files and folders
• uploads, downloads, and SFTP ↔ SMB transfers
• desktop and mobile usability
• permission errors and interrupted transfers

Please report anything unexpected here. Include your WebSSH commit or container tag, SMB server type, browser, and exact reproduction steps, but never post passwords or other credentials.

[bifrost0x]

@elmocito

[elmocito]

Will have a try tonight, thanks, @bifrost0x :-)

[ap0int3d]

Hi,
I am trying to establish an SMB connection to a TrueNAS Core SMB share. According to my readings, TrueNAS offers encryption and signing natively through negotiation. It can be configured to enforce encryption for all connections if required but that is not the case in my current TrueNAS config.

In WebSSH, I get an error when trying to connect:

From the tests I have made with Windows clients, they use SMB 3.1.1 and encryption works fine. It seems that by default Windows "disables" signing when encryption is enabled (I am not an expert on this topic so please take this statement with a grain of salt).

Is there something I can do to bring more details ?

EDIT: After running a packet capture, I found that I needed to specify the realm with the username (e.g.: username@example.com). Moving on with the tests

EDIT2: Actually it works better to specify the DNS domain name in the "Domain" field and the username in the "Username" field.

[ap0int3d]

Hello again,

Here are some feedbacks on the various topics @bifrost0x requested:

• connecting and reconnecting to saved shares
  • Works as expected. Need to be careful with the username format.
• creating, editing, renaming, and deleting files and folders
  • Creating/renaming/deleting a folder works well
  • Renaming/deleting a file works well
  • Editing a text file does not work.
    • Error message: "Atomic replacement is not available for this SMB account"
• uploads, downloads, and SFTP ↔ SMB transfers
  • Transfers between SFTP and SMB work well either direction.
  • Uploading from local computer works well
  • Downloading to local computer works well
  • Cancelling a transfer in any direction (SFTP/SMB, PC/SMB, PC/SFTP) is a challenge. You need to keep hitting the red cross over and over again if you want to have a chance to cancel the transfer.
  • Please note that during a transfer, navigating between folders in the involved hosts (either the source or the destination hosts) is impossible. You only get a loading sign and then if the transfer is long enough a timeout. The pane refresh automatically at the end of the transfer.
• desktop and mobile usability
  • Not tested on mobile.
  • On desktop. experience is good. File Manager misses a way to move a file between folders in the same host (either a button or drag and drop)
• permission errors and interrupted transfers
  • So far so good with the permissions but I only tested with one user account.

Side note: File Manager seems to have a size limit for the file transfers but does not show any message when trying to transfer an oversized file.

[bifrost0x]

thx a lot for you support @ap0int3d ! i am already working on the fix :)

[bifrost0x]

Thank you again for the detailed testing, @ap0int3d.

I have opened #149 to address the feedback from your report:

• text editing keeps revision checks and offers an explicit recoverable replacement path when atomic replacement is unavailable; rollback failures report only safe recovery artifact names
• SMB browsing and metadata use a separate control session from bulk transfers, so navigation no longer waits behind the transfer stream
• cancellation is one idempotent action with a visible Cancelling state and an authoritative terminal result
• known oversized operations show the actual size and configured limit, while all limit failures now have a clear reason
• two folders from the same source now offer Move, with no silent overwrite and safe conflict handling
• SMB connection and operation failures now provide stable, actionable reasons plus a safe diagnostic reference where applicable

The change is covered by the full Python, JavaScript, and browser suites, plus an encrypted SMB 3.1.1 Samba integration test.

If you can retest #149 against TrueNAS Core, the most useful cases are recoverable text editing, navigation during a long transfer, one-click cancellation, same-share Move, and an oversized file. Please keep passwords and sensitive share details out of the report.

PR: #149

[ap0int3d]

Hi,

Text editing:
I can now edit the text file.
Each time I want to save, I get the following message:

Most users might not understand what this means (I am not even sure I understand myself 🤣 ).

Share browsing while transfer occurs:
I am now able to browse the SMB share during a transfer (whether it is the source or destination).
I still cannot browse the SFTP "share" during a transfer no matter if it is the source or destination of the transfer.

Transfer cancellation
I experience the same behavior as before the #149: I need to keep clicking the button for the transfer to maybe actually cancel.

Same-share move:
I cannot find the option to move a file or folder in the GUI.

Oversized files:
The "Transfers" pane in the lower part of the File Manager indeed now show an error message stating the file is too large.

However I get the following ephemeral message in the top right corner:

[bifrost0x]

Thanks again for the detailed TrueNAS Core retest, @ap0int3d.

The remaining issues identified during that retest were addressed by PR #152, which has now been merged into main:

• a confirmed cancellation request now terminates the transfer reliably on the first click
• SFTP directory browsing remains responsive during active transfers by using separate transfer and control channels
• moves within the same source are now visibly labelled Move
• failed, partially successful, and cancelled upload batches now show the correct status instead of a false success notification
• the SMB recovery-save prompt now uses plain language, and consent is remembered per connection until the page is reloaded
• the SMB login form and documentation now explain the UPN username format required by some TrueNAS and Active Directory setups, for example user@example.com
• file actions in the embedded view are correctly re-enabled after returning from the full file manager

PR: #152

All CI checks passed, including the Python suites on both the current and minimum supported Python versions, browser end-to-end tests, SMB and SSH integration tests, container and threading checks, CodeQL, and image security scanning.

If possible, one final real-world retest against TrueNAS Core or Active Directory would be very helpful. The most useful cases are one-click cancellation, SFTP browsing during a long transfer, the visible same-share Move action, an intentionally oversized upload, and two consecutive text-file saves. Please continue to keep passwords and sensitive share details out of the report.

[ap0int3d]

Hi,

Regarding the UPN format to login to the SMB share, it is not actually required (at least not in my setup). For some reason I completely overlooked the "Domain" form field. I retried connecting to the TrueNAS Core SMB share with the "Domain" field filled with my AD domain (e.g: example.com) and with the "Username" field containing my account' sAMAccountName instead of UPN. It works even better than with the UPN and "Domain" not filled. Indeed until I moved to using the "Domain" field and sAMAccountName, I was unable to access my private SMB share hosted on TrueNAS.
Please note that the domain's Netbios name does not work when used in the "Domain" field or in the username field.
Sorry for misguiding you on this one.

Transfer cancellation:
Still does not work reliably for me unfortunately. Most of the time even if I keep clicking on the cancel button, the transfer goes through.

SFTP browsing during transfer
Works ! 👍

Move action:
I must not be doing things properly as I still do not see the Move action. Could you please describe how this should work ?

Oversized transfer
The status notification is correct.

Consecutive text file saves:
First save: I get the popup with a much clearer message. 👍
Second save: no popup, file is just saved. 👍

Side notes:

• when opening an empty folder in either SMB or SFTP, there is no parent directory arrow as we can find in non-empty folders:
  Non empty folder:

Empty folder:

I know there is a parent folder button near the home button but it feels strange not to have this link "in-folder" at all times.

• If opened, the "Transfer" pane should scroll down automatically when adding new transfers in the queue.

[bifrost0x]

Thanks again for the precise follow-up, @ap0int3d.

The remaining items from your latest report have now been addressed and merged into main via #156:

• Cancellation is now worker-authoritative. An active transfer enters Cancelling immediately, but quota and source holds remain in place until the worker confirms that I/O has stopped. Exactly one truthful terminal result wins, including for the legacy SFTP-to-SFTP path.
• Move is easier to discover. The source picker marks the exact connection that enables Move, and the action area now prompts you to select items to move. The exact source identity and conflict protections are unchanged.
• Empty non-root folders retain the in-list parent entry (..).
• An open transfer queue follows newly appended transfers automatically, while manual scrolling through older history is preserved.
• The SMB login guidance now recommends a DNS domain such as example.com together with a sAMAccountName such as alice. Leaving Domain empty and using alice@example.com remains an alternative. The documentation also notes that NetBIOS names may not be accepted.

To use Move, load the exact same active connection into both panes, browse to different folders, select one or more items in the source pane, and choose Move. The source picker will now identify the matching connection with Same connection - enables Move.

All CI checks passed, including both Python versions, browser end-to-end tests, SMB and SSH integration tests, CodeQL, container checks, and image security scanning.

PR: #156

If you have time for one final retest against the current main build, the most valuable checks would be one-click cancellation for SFTP-to-SFTP and SFTP-to-SMB transfers, the same-connection Move flow, opening an empty folder, queue auto-follow, and the corrected TrueNAS login guidance. Please continue to keep passwords and sensitive share details out of the report.

[ap0int3d]

Hi,
I finally understand how to use Move. I did not get that I had to open the same active connection in both panes.

What I had in mind was:

• (Optional) Supporting drag and drop of a file or folder into another folder within the same pane.
• Having a "Move" button in the action buttons of each pane which would open a popup allowing to browse to the target folder for more "complex" scenarios.

Something like this:

Please don't take this the wrong way but the way it is implemented right now feels overly complicated.

I'll follow up with the requested tests later today.

[ap0int3d]

Hello again,

One-click transfer cancellation
Still no luck with this one. Tried with MS Edge and Firefox. Behavior is the same.

Same-connection Move flow
Working for both SFTP and SMB. Please see my previous message for feedback about the current implementation.

Empty folder
The in-list parent folder entry is here and working as expected for both SFTP and SMB.

Queue auto-follow
Works !

SMB share login guidances
For TrueNAS, it is important to input the "Domain" field as TrueNAS may be connected to multiple authentication sources (local, AD, LDAP and NIS most notably). This allows TrueNAS to perform the authentication to the proper directory. If using TrueNAS local accounts, there is no domain so it can be left empty. This should be true for most SMB shares hosted on UNIX/Linux-based hosts.

For domain-joined Windows servers hosting SMB shares, user can simply input their sAMAccountName and password leaving the the "Domain" field empty. Since Windows is domain-joined and can only be joined to one single domain, Windows Server is most likely infering that the user is in the same domain.
You can also use:

• the UPN as username ("Domain" field empty) or
• input the Netbios name of the domain in the "Domain" field with the sAMAccountName as the username or
• input the DNS domain name n the "Domain" field with the sAMAccountName as the username.

All this work in a single forest, single domain AD architecture.
Things might be different in other AD architectures (single forest, multi domain or multi forest, multi domain). I have no way to tests those cases.

For non domain-joined Windows servers, it should be as simple as inputting local username and password without domain. But this case was not tested.

In my opinion, all the above can be stated in the Wiki but it is probably going to take a lot of space in the Connection page within WebSSH unless you add this as a tooltip or something equivalent. But I would personally simply leave a link in WebSSH redirecting to the Wiki for more information.

[ap0int3d]

Hi,

Move experience:
In my opinion user experience is better in #158 than in #159. I am not quite sure the removal of the Move button from the action bar in #159 is a good thing.
In any case, Move works well on both SMB and SFTP.

However I still think that opening a popup file browser overlaying the pane on which the "Move" button was clicked would be an even better experience.

Please see below example:
Imagine you want to move the file called "README" in the left pane into the folder called "Target_Folder" in the screenshot below:

After selecting the file, you click on "Move...", here is the kind of thing that should happen in my opinion:

Ideally the "Select targer folder" window should be over the pane that started the move operation but I can live if it is centered 😆
Hiding the files to only show the folders is just food for thoughts.

Working this way could also be duplicated to the Workspaces SFTP pane. Thanks to this overlay, it would not be needed to get to the File Manager to move a file. This can be achieved directly from the Workspaces tab.

SMB guidance:
Seems clear enough for me.

PS: Love what you did in #158 with the section tab for Workspaces, File Manager, Hosts and Commands ! Things look more "integrated" now ! Great job !

[bifrost0x]

done :)

[ap0int3d]

Wonderful ! It works perfectly ! Thank you very much !