2

The premise

I've been tasked with finding a solution to the following scenario:

  • our main file server is a Linux machine.
  • on the LAN, users simply access the files using SMB.
  • each user has an account on the file server and his/her own access rights.
  • user accounts are simple passwd/group security accounts, not NIS/LDAP.

The problem

We want to give users (or at least some of them, say if they belong to a particular group) the ability to access the files from the Internet while travelling.

Ideally

  • I'd like a seamless solution. Maybe something that allows the user to access a mapped drive would be ideal.
  • A web-oriented solution is also good but it should present files in a way that is familiar to users, in an explorer-like fashion for instance.
  • Security is a must of course, and users would be expected to log-in.
    The connection to the server should also be encrypted.

Anyone has some pointers to neat solutions?
Any experiences?

Edit
The client machines are Windows only.

Improve this question

8 Answers 8

Reset to default
6

OpenVPN will make you very, very happy, I think. It's pretty easy to setup with static keys for testing and playing around, and only marginally more difficult to setup with certificates when you're ready to go into production.

You can require logins on the clients via your server's PAM (and thus your /etc/passwd file), in addition to either static keys or certificates, by using the "auth-pam.pl" script provided and the "auth-user-pass" directive in your client configurations.

The OpenVPN GUI for Windows is very nice, so if your clients have Windows machines it won't be a jarring command line-based experience.

All-in-all, I've been very pleased with OpenVPN.

  • http://openvpn.net/static.html - Static key mini-HOWTO. Not recommended for security, but a great way to get a feel for how OpenVPN works before diving into simple PKI.
  • http://openvpn.net/howto.html - Includes some documentation re: PAM authentication. Start w/o PAM first to get it going, then add it on.
Improve this answer
1
  • I'd like to point out the ability to send preconfigured openvpn installers to clients. This makes roll-out much easier
    – bobby
    Jun 8, 2010 at 0:52
3

Have you considered WebDAV ? IIS has support along with NTLM authentication, on the client side you can use the Webfolders extensions built into Explorer since XP.

Improve this answer
1
  • I thought about it but I'm not too sure: the connection isn't secure, which means you need to setup SSL separately and I'm a bit uneasy about the security issues and flaws in the various implementations. Maybe I'm just biased and I need to look it up further.
    – Renaud Bompuis
    Jul 8, 2009 at 3:10
2

What about sshfs? That would take care of the requirements for passwords & encryption as well as the mapped drive type access.

If users already have accounts on the file server then it shouldn't require too much work to implement it on that end.

Improve this answer
1
2

Your best option is to set up a VPN solution for your clients. This will satisfy all of the requirements that you specify. The connection will be encrypted, clients will only have to map a drive just like they were in the office, they would still have access to everything else on your network just as if they were in the office. The only thing they would need to learn is how to log in to the VPN which is trivial.

Improve this answer
2
  • Do you recommend any good tutorial that describe the setup on Windows clients and Linux servers?
    – Renaud Bompuis
    Jul 8, 2009 at 3:12
  • Go with Evan Anderson's recommendation of OpenVPN
    – squillman
    Jul 9, 2009 at 4:12
1

Xythos shared document management is a nice solution. Cost depends on setting, install size, etc, but it's a web interface with folder structure very familiar to Windows users. Many features available.

Improve this answer
1

To answer my own question.

Apart from creating a VPN, the best solution I have found so far was to use WinSCP as a way to securely access the fileserver without opening the whole internal network.

Properly configured, WinSCP can look just like the familiar Windows explorer; it becomes easy to work on files, even allowing double-click to edit a file (the file is downloaded to a local temp directory, then automatically uploaded back when you save or close it).

The main issues are that out of the box:

  • WinSCP defaults are not adequately for general users.
  • the default Linux server shells for user accounts (such as bash or sh) will expose the complete server file-system instead of just the data or home directories.

Both are easy enough to fix though:

  • Configuration of WinSCP is flexible can be saved to a ini file that can then easily be deployed.
  • The default shell users log into on the server can be replaced by MySecureShell that has various configuration settings to control the visibility of the files accessible to the user.
Improve this answer
0

You haven't said what OS the clients have. In the case of Windows clients at least you can map a drive letter to an FTP connection. Perhaps similar can be done with Linux.

Improve this answer
1
  • Client machines are Windows XP/Vista. FTP doesn't encrypt connections so I'm really reluctant to use it. Does mapping a drive to FTP work in Windows?
    – Renaud Bompuis
    Jul 8, 2009 at 2:51
0

You can install PopTop on the server, and use Windows built-in VPN software (PPTP).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .