Is it safe for a single directory/file to be served by two separate samba daemons simultaneously?

Question

The situation is this:

• I have a Debian server which acts as a web/mail server as well as an Internet gateway for a small office. All the externally available services run on OpenVZ virtual environments.
• I have a requirement to provide external access to a directory (for a designer) shared with the employees inside the office. The directory must be accessible via SMB, so I've set up OpenVPN to provide secure access to Samba over the internet.
• For additional security, I don't want to give OpenVPN remote users (which there might be more of in the future) full access to the company network, so I plan to set up a Samba daemon on one Virtual Environment, listening only on the OpenVPN virtual interface, and a separate Samba daemon on the physical machine, listening only on the internal network interface. The daemons would serve the same directory located inside the VE's root tree (and accessible to the physical machine's OS).

The main question is this: Won't there be conflicts (file locking issues, etc) when the files are accessed simultaneously from the internal network and the outside (which is likely as this setup is for Adobe InDesign/InCopy collaboration)? If so, what would be a better setup in this situation? Another alternative i'm thinking of is making the internal Samba daemon accessible on the OpenVPN interface through port forwarding. Again, I don't want OpenVPN clients to have actual full access to company network, i just want Samba shares working across the Internet (which the planned workflow requires).

If somebody has any experience with a similar setup, I would be very grateful if you shared your insights.

Edit - clarifications: I use OpenVPN with a bridged VPN (a tap interface) as I understand that is the right choice for Samba (would it even work on a routed VPN? Wouldn't it require elaborate forwarding/routing setup?) However, I don't want to bridge the VPN with the physical server's interface for 3 reasons: Avoid disturbing the company network while bringing the interface up&down; Avoid granting external clients access to the whole internal network; As a policy rule, avoid running public services on the physical machine.

Currently, I plan to use option 1:

• option 1: running OpenVPN and Samba on a VE for the external clients and a second Samba instance on the main server for the employees (who don't need VPN). However I worry about two instances of Samba serving the same files and clashing (hence the original question formulation).
• Option 2 would be to run just OpenVPN on in the VE and forward the Samba ports to the physical machine (or Hardware Node in OpenVZ terms).
• Option 3 would be to not bother with VEs for this service (as it's essentialy non-public) and just run OpenVPN on the Hardware Node with a tap (bridge) interface but NOT actually bridge it with a physical interface, then make the single Samba instance listen on the internal network interface & the tap interface (for VPN clients), and NOT listen on the external interface.

So, the updated question would be: would option 3 be any less secure than the first two? If not, I would implement it as it seems to be the simplest and most robust.

Sorry I couldn't express it in less words :) Thanks for reading and answers.

Answer 1

I'd just use a firewall to control access. To make this work you would have to have OpenVPN setup to use a tun interface and route the traffic through a firewall. Once you have that done you have a couple of options for limiting access. You can assign a static IP address to the contractor using the client-config-dir directive and then restrict what that IP address can access. If you keep the statically assigned IP addresses in a block of IPs that can be described using a different CIDR from the OpenVPN DHCP users (employees) then you can write firewall rules easily to target each type of user. The other option which I tend to prefer as over all I find it cleaner to manage is to setup 2 different OpenVPN servers on different ports using different subnets for the clients and use one for employee access and one for contractor access. Then you can apply any restrictions you would like on either group based on the subnet without having to deal with individual IP addresses.

On the SAMBA side of things you can simply rely on the permissions on the files to restrict what he sees. But if you don't want to, or can't, expose all the normal shares to the contractor b/c they may disclose information like client/project list then you can use the invalid users = <username> option on the shares you wish them not to see. And add a share just for the contractor using the valid users = <username> directive. Another option would be to use the include = /somepath/%G.smb.conf or include = /somepath/%u.smb.conf directives to do per primary group or per user configuration directives.