We have a Samba server with LDAP authentication running. User privileges are controlled by UNIX groups and ACL and everything works just nicely.

In the future we will allow users to connect via VPN but with fewer rights. We'd like to have a mechanism allowing us to "share" certain folders for those connecting from outside.

All VPN connections come from a 172-subnet.

Now, is there a way to tell the server behaving like "If jdoe connects from 192... give him full privileges. If jdoe connects from 172... limit him to the folders marked as VPN-safe (whatever that might be, ideas?)"

Many thanks in advance!

  • Solved by creating a vpn-user for each regular user and setting a share only accessible for a vpn-Group symlinked to the original share. – user1989830 Nov 11 '14 at 13:12

That sounds like the basic "hosts allow" or "hosts deny" options, which can be set on specific shares as well as globally.

You could do something like:

[sensitive share]
    hosts allow = 192.
[VPN Friendly Share]
    hosts allow = 192. 172.

Does that achieve what you're looking for?

  • I need the same root folder for both shares which basically is no problem . But then I need to decide for each subfolder whether it is accessable via VPN. I thought about a 'path = /srv/%i' solution and using two ip addresses and a fancy symlink structure but that does not work for the server is not accepting a %i in the path. – user1989830 Nov 10 '14 at 9:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.