Linux – Windows network share on linux server without samba

file-sharinglinuxSecuritysoftware-recwindows

I want to mount shared folders from my linux server on the network to appear like normal drives in Windows.

The server has a private network on one side and a public network (which happens to give me a semi-static IP on the internet) on the other side. I am using both networks and want a samba-like filesharing ability.

Why not samba:

it has no encryption
it spams the public network
it is said to be very unsafe

At the moment I use sftp mainly and I would love to have some shares integrated into windows, is this possible? If there is a way to secure and harden samba, especially adding encryption – transfer and login – it would be fine too though.

Edit: To make it more clear, I allready use WinSCP so I am not looking for an FTP-like client software but for an integration comparable to samba. (mount network share, assign drive letter)

Edit2: I think further Explanation is needed how my network looks like:

I live in one of the universities dorm appartements, and can access the universities network from my room. My server/router (same box) is connecteted to the network which hands out an IP via DHCP which is accessible through the internet, too. Thats why I call it semi-static, it basically does not change unless I switch my server off for more than a few days. As that box works as my router I have a private network on the other side too.

As long as I am within the reaches of the universities network (read most of the day) I want to access my servers files. Simple sollution would be to allow all internal adresses of the universities network, but I do not trust this network to be safe. I still want access to the files, not through a client bases sollution like WinSCP or FileZilla offer, but a true integration as a filesystem.

Best Answer

This question on StackOverflow might be of interest.

Dokan seems to be an interesting way to mount network locations more safely.

Related Solutions

Linux – Mount a Samba share using Kerberos ticket

If you are signing in with a windows domain user a Kerberos ticket is already requested. You can test it by executing klist.

To reuse this ticket you have to add user and cruid option to your mount order. This way you do not have to enter any credentials again.

sudo mount -t cifs -o user=$USER,cruid=$USER,sec=krb5 //domain/path /home/path

To mount the share with your user as owner (and thus with write permission) add the gid and uid options.

sudo mount -t cifs -o user=$USER,cruid=$USER,sec=krb5,gid=$GID,uid=$UID //domain/path /home/path

You get your $GID by running id -g $USER and your $UID by id -u $USER.

It may be that you have to apt-get install keyutils to get this working.

Linux – Access Samba share from Windows 10 in VirtualBox

Some Linux distributions have a so called SELinux implementation in its kernel. It stands for "Security-Enhanced Linux" and, beside other things, restricts Samba shares. If you want to create a share folder then it's not not enough to specify convenient access permissions and a definition in samba.conf. You also need to set the correct "Security Context" of the share folder.

Following permission mask and security context should do the trick:

chmod -R 770 yoursharefolder
chcon -R -t samba_share_t yoursharefolder

All conditions that are already known from different wikis must also be adhered:

Unix user as owner of the share must be added to Samba user database: smbpasswd -a youruser
Your windows machine must have a user with the same name and same password as set in Samba database
Your samba.conf may look like this:

samba.conf (all upper-case parts must be customized for your concerning specific environment):

[global]
workgroup = SAME_WORKGROUP_AS_CONFIGURED_IN_WINDOWS
server string = Samba Server %v
netbios name = HOST_NAME_OF_YOUR_LINUX_MACHINE_ON_NETWORK
security = user
map to guest = bad user
dns proxy = no

[yourshare]
path = /PATH/TO/YOURSHARE
valid users = YOUR_WINDOWS_USER_NAME
browsable = yes
writeable = yes
guest ok = no
read only = no
directory mask = 0770
create mask = 0770

Edit: Note that changes via chcon aren't permanent. In order to do permanent security context changes use following command:

semanage fcontext -a -t samba_share_t /full/path/to/your/share/folder

...and to make it effective:

restorecon -v /full/path/to/your/share/folder

Best Answer

Related Solutions

Linux – Mount a Samba share using Kerberos ticket

Linux – Access Samba share from Windows 10 in VirtualBox

Related Question