Root samba auth not working

As requested, 12.0-RC1 release notes and SMB sharing documentation have been updated to warn against using the root account or built-in users for SMB shares.

This has to do with how SMB authentication works. NTLM auth (used in non-AD environments) requires that the server have an unsalted MD4 hash of password in memory for challenge/response. New validation routines related to it are as follows:

Going in reverse order. The password change requirement is due to the need to generate a secondary hash of password (md4) and store in the config file. This means that we must ask for a password reset whenever users switch from non-SMB to SMB.

The "attribute may not be changed" error regards a list of attributes that may not be changed for builtin users. One of these is "smb" for the fairly mundane reason that builtin accounts shouldn't be used for SMB. Among other things, this requires us to begin storing password hash for accounts such as root in a form that is more vulnerable to cracking.

As you yourself admitted, using the root account for SMB is fairly far from "best practice", and it is something we are putting guards around for our general users (which includes businesses and other places where security is somewhat more important).

The changes are being made in pre-release versions of TrueNAS, and so you have time to migrate any production servers on 11.3 to something more standard before you are impacted.