SMB: optional legacy mode (SMB1 + NTLMv1) for old clients

Supermicro BMC virtual media ("CD-ROM image" over a Windows share) only
offers the SMB1 dialect "NT LM 0.12", which Samba rejects with
server min protocol = SMB2. Add an opt-in "Allow legacy clients" SMB
setting that renders server min protocol = NT1 and
ntlm auth = ntlmv1-permitted. Off by default.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/shares/model.go

@@ -28,6 +28,7 @@ type SMBConfig struct {
 	Enabled      bool       `json:"enabled"`
 	Workgroup    string     `json:"workgroup"`
 	ServerString string     `json:"server_string"`
+	Legacy       bool       `json:"legacy"` // allow SMB1 + NTLMv1 (IPMI/BMC virtual media, old devices)
 	Shares       []SMBShare `json:"shares"`
 }
 

internal/shares/render.go

@@ -37,6 +37,12 @@ func RenderSMB(c Config, owner string) string {
 	if anyGuest(c) {
 		mapGuest = "Bad User"
 	}
+	minProto := "server min protocol = SMB2"
+	if c.SMB.Legacy {
+		// old embedded clients (e.g. Supermicro BMC virtual media) only offer
+		// SMB1 "NT LM 0.12" and authenticate with NTLMv1
+		minProto = "server min protocol = NT1\n   ntlm auth = ntlmv1-permitted"
+	}
 	g := []string{
 		"workgroup = " + c.SMB.Workgroup,
 		"server string = " + c.SMB.ServerString,
@@ -44,7 +50,7 @@ func RenderSMB(c Config, owner string) string {
 		"security = user",
 		"map to guest = " + mapGuest,
 		"guest account = nobody",
-		"server min protocol = SMB2",
+		minProto,
 		"unix charset = UTF-8",
 		"logging = file",
 		"log file = /var/log/samba/log.%m",

internal/shares/shares_test.go

@@ -46,6 +46,13 @@ func TestRenderSMB(t *testing.T) {
 	if out := RenderSMB(c, "ansible"); !strings.Contains(out, "map to guest = Never") || strings.Contains(out, "Bad User") {
 		t.Errorf("user-only config must not map to guest:\n%s", out)
 	}
+	if out := RenderSMB(c, "ansible"); strings.Contains(out, "NT1") || strings.Contains(out, "ntlmv1") {
+		t.Errorf("SMB1 enabled without the legacy flag")
+	}
+	c.SMB.Legacy = true
+	if out := RenderSMB(c, "ansible"); !strings.Contains(out, "\n   server min protocol = NT1\n   ntlm auth = ntlmv1-permitted\n") || strings.Contains(out, "SMB2") {
+		t.Errorf("legacy mode:\n%s", out)
+	}
 }
 
 func TestRenderExports(t *testing.T) {