I run a Samba 4 instance at a small private school. This makes a regular Linux server appear as a directory controller. There are two relevant benefits to this:

  1. I have a Samba share for people's documents, and I use the Redirected Folders feature to allow any employee to sit down at any PC, log in with their domain credentials, and their My Documents points to network storage.
  2. Everyone has a mapped drive (using Group Policy Preferences) to a share specific to their account type. Students can access one share (one share for all students), teachers have another, and office staff have another.

However, I would like to allow BYOD (Bring Your Own Device). Some employees are already asking for it with their personal laptops, and I know eventually most everyone will want to.

Is there any way to replicate the two features above without having to join PCs to the domain? Joining personal PCs is impractical if only because only professional editions of Windows support this.

Ideally, any operating system (including mobile) could access the relevant shares, but of course Windows is key. Offline caching is optional. (I could set up OpenVPN for teachers who want to access their files from home.)

The problem with simply giving SSH access to the relevant shares is primarily that Samba 4 relies on ext4 ACLs and ext4 extended attributes to maintain NTFS permissions. Writing files directly to the Linux server would bypass this and would (probably) not be interoperable with Samba4.

Right now I am completely flexible. I am even fine with scrapping the whole domain and using some other software for the two features above.

How can I allow school employees and students freedom to securely share files without requiring everyone to have specific editions of Windows?

  • 1
    You should be able to access shares using domain credentials from a machine that's not on a domain, but I don't know of any way to get the benefits of automatic redirection or mapped drives on a non-domain machine. – davidcl Oct 9 '12 at 23:52
  • Thanks, @davidcl. I would be okay with using alternatives to the Microsoft technologies, such as WebDrive and ExpanDrive, but something more suitable. – Philip Oct 10 '12 at 3:18

Why not take another route. Have them use VPN from their own devices. The proper way would be to allow them wirelessly on a guest network and have the vpn to access relevant sources. With this you can protect your network from untrusted devices. Trust me the last thing you want to do is run around and figure out who's laptop is generating suspicious traffic.

Once they are connected to the VPN they can map the network drives with their directory credentials.

Cheers, Dexter

| improve this answer | |
  • but how are they going to authenticate in order to access the network drives? VPNing into the network gets them IP-level access to the server, but not integration with Active Directory. – Philip Nov 28 '12 at 18:48
  • Ok,have you tried looking at this, OPENVPN AD AUTHENTICATION. As I understand it, once you have logged in via VPN you can then access shared drives with your cached credentials. Remember if a user is using his personal laptop, he will need to login with his AD credentials to access the network share. Windows then caches this, until his password expires I think. – Danie Nov 29 '12 at 5:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.