Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a situation where there are three subnets within a building. Each subnet essentially isolates separate units within this group. In looking at different options for a file server, I am trying to research if it is possible to setup a single file server to support all three subnets. What I am unsure of is how to restrict which directories can be viewed based on which subnet the request is coming from or if it is possible (though, with it being 2013, I expect it probably can). It is a mixed environment with end users having OSX or Windows 7 and the total number of users across all three subnets is less than 250, averaging 130 any given day. There is no established OS baseline for servers, though I am attempting to migrate as much as possible to CentOS as replacement time comes around.

Thank you for your help!

share|improve this question
    
Do you have Active Directory? –  ewwhite Mar 27 '13 at 13:02
    
Yes, there is AD. However, the OSX users do not authenticate against that to log into their machines. –  Josh Blair Mar 27 '13 at 13:06
add comment

2 Answers

up vote 1 down vote accepted

Just restrict the source IPs for the individual shares. If using CIFS or Samba, something like:

hosts allow = 192.168.1.

But I don't think that subnet is an appropriate security delimiter. What stops users from physically connecting from a different subnet?

Group, user or Organizational Unit security policies would make more sense.

share|improve this answer
    
Having followed this site for years, your answers are spot on. I agree that subnet is not ideal, though, a vast majority of the users are using workstations mounted to their desk. The only ones with laptops/mobile are IT staff, so no restriction would be ideal. So to answer your question, the workstations being mounted is the primary defense against physically connecting to another subnet. –  Josh Blair Mar 27 '13 at 13:15
add comment

If there is a need to restrict access to file shares at all within the company based on department/need-to-know, then subnet restriction is not going to do it. Even if you set up something that does "restrict" access to a particular share based on subnet, you have no authentication or authorization mechanisms to determine if the access is being performed by a user in that department who should be accessing the file share or not. Somebody could either just plop down a machine (a work machine or an outside machine) in that subnet and access the share unrestricted essentially.

I have no experience with anything but Windows file shares, but since you have AD I would think the route to go would be to get a Windows file server. You can then lock down the file shares based on user and AD group membership. Even though some users don't authenticate to AD when they log into their workstations, they should be prompted for credentials when trying to access the file share and then would have to authenticate using their AD credentials.

share|improve this answer
    
I thought about that, but I took ew's answer and am going to combine that with DHCP. Have the DHCP assign addresses based on MAC (and if it isn't an authorized MAC, black hole it). Within the directory structure, there is not much need to restrict permissions; the main division that needs to exist is between the subnets. –  Josh Blair Mar 27 '13 at 14:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.