Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a folder on a Linux server that I need to share with a number of different clients all over the country. Some requirements:

  1. The folder needs to be mountable as an ordinary network drive in Windows
  2. The system should not require a great deal of configuration on the clients' side
  3. The share needs to be available at all times

The first thing that came to mind was using Samba over the Internet. However, having researched this a bit, everyone keeps advising against using Samba over the Internet, instead recommending alternatives such as SSHFS or an SFTP server, which fail one or both of my two first requirements.

The final alternative that I've seen suggested is setting up a VPN server and making clients connect through VPN to get access to the Samba share. However, using VPN either channels all network traffic through my VPN server, which forces the user to connect to the VPN server only when they want to access the share, which fails requirement 3 and also makes the share difficult to use for non-technical users.

This takes me right back to the start -- what exactly is so insecure or otherwise bad about exposing Samba to the Internet, given a good firewall, an IP whitelist in the Samba configuration, and encrypted network transport in Samba?

share|improve this question
    
Your first requirement is a little odd. Is there an application running on their computers that needs access to data via a specific drive letter? Why can't you provide the data to them via a web server? –  red888 Nov 18 '13 at 15:53
    
The application that needs access to the data on each client computer only knows about the drives (or Samba shares without drive letters) that Windows makes available to it, and has no way to interface with the Internet at all. –  Aqwis Nov 18 '13 at 15:58
1  
I think the solution is to fix the application. Obviously not an answer to your question, but this is a pretty kludgy app. I'm not a developer, but I think you use SOAP or REST for this kind of stuff. –  red888 Nov 18 '13 at 16:03
    
It's not an application that I or any of the clients have developed, but a very big content management system that is used by a number of major players, that I unfortunately have absolutely no control over. –  Aqwis Nov 18 '13 at 16:05

2 Answers 2

The SMB protocol allows for unencrypted data transfer once authentication is complete and connections are established. Anyone snooping the wires can intercept the data being transferred back and forth via your share(s).

If you have encrypted transports for your network shares, though, that is mitigated.

share|improve this answer
    
Is this actually a problem? After all, the passwords can also be encrypted, so what kind of useful data can they snoop on? –  Aqwis Nov 18 '13 at 15:43
    
As far as I understand if you access the Samba share using "smbclient -e" or the equivalent in newer versions of Windows, everything is encrypted. –  Aqwis Nov 18 '13 at 15:45
    
Sorry, was editing in the last line of my answer as you were commenting. You should also look at server signing, though, to ensure your clients are connecting to your server and not something else pretending to be. I also fixed the typo in my first sentence... –  squillman Nov 18 '13 at 15:55

No matter whether your Samba is encrypted or not, such service placed to a public area becomes to be a subject of interest. I do not think this is the what you want. Just use VPN. With proper setup your client can use VPN to acces your samba share and normal Internet connection for all others, simultaneously.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.