Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm looking for ways to encrypt Microsoft SMB data traffic between a client and Windows server or filer appliance. This is not about encrypting the authentication but the actual data transfer.

Is IPSec from the client to a Windows Server my only option?

share|improve this question
    
Any reason why you don't want to use IPSec - on Windows server it's just a matter of applying a couple of security templates - it's simple and free! –  Jon Rhoades Jun 10 '09 at 2:02
    
Most of our primary storage is on filer appliances and not windows file servers (though both are options for the project that I'm currently working on), and I wanted to be sure that there wasn't a protocol level option. IPSec may be the way I end up going in this case, thanks all! –  Bob Jun 10 '09 at 15:16
add comment

4 Answers

up vote 3 down vote accepted

CIFS/SMB doesn't have any protocol-level encryption options, so you're stuck encapsulating the traffic in an encrypted envelope. Which in all practicality means a VPN of some kind. Be it IPSEC, SSL, PPTP.

share|improve this answer
add comment

There's vague references to CIFS/SMB the TLS or SSL on the internet, but nothing obvious and not from Microsoft, so I'd assume it's not all that possible, common, easy or all three.

In that case, if you can't encrypt the protocol, you'll have to do encryption at a lower level, which means a VPN of some form. IPSec is just one way. You could use an encrypted pptp tunnel or something similar.

share|improve this answer
add comment

If you're not talking about adding other computers or software to the mix then, yes, IPsec or the built-in VPN functioinality in Windows is the only built-in way to encrypt CIFS/SMB traffic between a Windows Server computer and a client.

You could, obviously, stick hardware-based encryption devices between the client and the server (VPN gateways, routers doing IPsec tunnels, etc). You could install third-party VPN software onto the client and/or server, as well. You can do anything you want to encapsulate, encrypt, or otherwise slice-and-dice the packets once they're on the wire, as long as by the time they make it to the server computer they're decapsulated, decrypted, and glued back together.

share|improve this answer
add comment

A simple solution is to create a transparent SSL tunnel with stunnel by installing the client on all end points

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.