A way to disable the SMB signing mechanism at the Apple Time Capsule

afpsmbtime-capsule

Apple Time Capsule related technical question.

In short, – does there exist a way to disable at the Time Capsule the SMB signing feature?

Regarding the original SMB1 protocol, the signing mechanism is slowing down the overall performance extremely. For example, writing to the Time Capsule network share is over a Gigabit LAN connection at around 15 MB/s and goes down to around 2 – 3 MB/s when a lot of smaller files are transferred.

This behavior is SMB1 related and is therefore present on different operating systems and (older) NAS network devices. Newer SMB2+ versions have a different, more efficient, design which results in much reduced overhead in conjunction with the signing feature. I can confirm this for several older Windows 7 computers where their (SMB2 based) network shares can handle transfer speeds up to 100 MB/s.

The usual solution is to disable the SMB signing. This can be done on macOS (and other OS) quite easy: https://dpron.com/os-x-10-11-5-slow-smb/

In my case, however, it is somewhat more complex. Regarding the Time Capsule — I had to do this at the "server side" which is effectively the Time Capsule. I have experimented to deactivate the signing at the client side (Mac OS, Windows 7) but it shows no effect. The SMB1 network share speed is always very slow because the SMB1 signing remains active.

So, my idea is to find a BSD command which deactivates the signing at the Time Capsule. The earlier Time Capsule models (up to the fourth generation) are NetBSD 4.0 based. The last model, the fifth generation, is based on NetBSD 6. There exists a non-official way to access the Time Capsule through SSH. 😉

And finally, a switch to the Apple AFP protocol is not a real solution because the Time Capsule share is also used under Linux and Windows. AFP is therefore only a solution for macOS based systems. However, Apple itself regards AFP as deprecated. It is no longer supported with the new APFS file system. Apple uses for APFS based network shares newer SMB versions.

Best Answer

Okay, here follows a litte addition to my original question. This is not a final answer. It can be seen more as the first part of a "real" solution. ;-)

As mentioned in the comment section by user Gumminando, Apple is using at the Time Capsule a (modified?) Samba Server. According to the official doc the SMB1 "server signing" feature can be defined in the smb.conf file as follow: (Source: https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html)

  • server signing = default
  • server signing = auto
  • server signing = mandatory
  • server signing = disabled

Apple is using at their TC models most likely the mandatory parameter which enforces the SMB1 signing in any case.

It should be noted that all these options are only SMB1 related. The SMB2 signing (of newer Samba versions) cannot be disabled because it seems to be "in design" mandatory. Well, a SMB2 functionality is not present at any Apple Time Capsule model so that aspect can be ignored anyway.

So what would be now the final solution? In theory, you just have to log / hack into the TC and modify the smb.conf file with parameter server signing = disabled or server signing = auto. Unfortunately, it's not that easy in practice.

However, I can confirm that the slow SMB1 signing affects primary larger files. I have now tested this for a while and the overall behavior with smaller files like office documents is okay. Well, this may be true in our case because the original TC hard-disk drive was replaced with a Crucial MX500 2TB SSD. Yes, this works GREAT.

And finally, the idea to use also under Linux the AFP protocol to access the Time Capsule seems interesting. Unfortunately the current AFP Linux implementation is somewhat broken (and incomplete). The SMB1 implementation may be slow but it is definitely very stable and reliable. I would describe it as rock solid.