how to better secure smb share from linux to windows

U

umcpgrad

2[H]4U
Joined
Apr 2, 2004
Messages
2,800
what is the best way to secure smb share on linux for file access to windows?
is it syntax to global or share within samba.conf/ smb.conf?

dir = *
hosts allow = * (ip that can access the share?)
 
Yeah, you can use the smb.conf file to restrict access by IP address, and you can also use it to limit access to the shares to only certain users and groups.
 
am I doing it correctly with the syntax I have it up there? do I input the syntax in global or the share section?

I tried it and use hosts allow and try to only let one ip to access and it still allow others to access it.
 
You can limit by IP to the share either globally or on a share basis.

For example, to allow only the 192.168.0.0/24 network access to my 'stuff' folder this would do it:

Code: 
[stuff]
path = /stuff
writable = yes
hosts allow = 192.168.0.

I wouldn't recommend using /etc/hosts.allow for restrictions to smb.
 
I want people to access the server, but only want one ip to hit the smb share on linux from windows
do I edit that under the share setting or the global setting if I only want one ip to hit the share on linux from windows?
thanks in advance guys
 
I read an interesting way to gain Windows control over files on a linux share recently. Specifically on a linux based NAS that did not have good controls.

Install truecrypt on the windows PC. Create an encrypted large virtual volume file (as large as you need, in my case 750GB) on the linux share that has access limited to the administrator and the windows computer with the virtual volume . Mount the volume in windows as a local drive. Apply NTFS permissions as necessary. The file decryption occurs in RAM so the performance hit is rather very small.

For all purposes you can treat the encrypted volume as a local drive. Think of it as a poor mans iSCSI for devices that don't support iSCSI.

As long as you have the truecrypt password for the volume you can always access that volume from another machine or even a portable version of truecrypt on a flash drive.
 
You must log in or register to reply here.
Back
Top