1

I have a requirement to deploy a Samba share to facilitate file sharing between a DOS 6 non-domain computer and a Windows 7 workstation which is a member of a Win 2008 domain.

IT will not currently cooperate although they are not preventing me from attaching a device to the network either. So at home I set up a simulation on VirtualBox, with a domain consisting of Server 2008 and a Windows 7 client, and a workgroup with FreeDOS and Debian Jessie.

I had to enable LANMAN authentication in Samba to support the DOS box connecting. Now I have E: mapped on the DOS machine, and on the Windows 7 machine I can browse to \\jessie\share using explorer.

So really I am wondering if this will work in practice on site, or could the group policy of the domain prevent me from doing this?

Further details

The DOS box controls some industrial machinery and the operators would like to load the CAD files onto it over the network. Apparently IT were asked to set this up and failed, which is why they are reluctant to talk to me about it. Having looked at other sites it seems the way to go is to map a network share to a local drive letter and deposit the cad files there.

The DOS machine cannot access the existing network shares as it is not a domain member. I am not entirely sure if DOS 6 can join a Windows 2008 domain, but it certainly won't be possible without IT's consent. So I thought of using a neutral file share that would be accessible from both the domain and non-domain computers.

I intend to use a Raspberry PI for the job as this also addresses some space constraints by allowing us to install the PI in the same enclosure as the DOS box.

The workstation is on a /29 VLAN segment so adding two computers might create a shortage of IP addresses. However, I solved this in my simulation by creating a totally different range for the PI and the DOS machine to talk on hence not interfering with the existing IPv4 LAN in any way whatsoever. And the Windows 7 box can find the PI using IPv6 link local.

  • 1
    I'm not seeing any constraint that mandates the use of SMB here. What would be the problem with other protocols like FTP? – James Snell Feb 6 '18 at 12:52
  • 1
    @JamesSnell That's a good point. While the DOS box needs to use SMB here, the Windows machines don't. Nothing to stop me running an FTP service along side SAMBA. If I ever get back to that job, I'll bear it in mind! – Rodney Feb 6 '18 at 13:24
0

I'm not aware of any specific option to prevent mapping a drive from a non domain source, but there are ways to block mapping drives completely in group policy e.g. User Configuration\Administrative Templates\Windows Components\Windows Explorer. Remove "Map Network Drive" and "Disconnect Network Drive".

  • OK found that thanks. I can still create a shortcut on the desktop to the share so that's fine. It's only the DOS machine that actually has to map a drive – Rodney Aug 31 '17 at 13:44
0

There has been recent (and not so recent) publicity around the security vulnerabilities in SMBv1 and LANMAN auth, and that there is group policy instrumentation to control that on a machine-wide scale. So you might find that somebody security-conscious one day tightens this up and by doing so breaks your access to the purposefully downlevel SMB share you created. They may even have done so already.

Also if your corporate network has NetBIOS disabled you will need a DNS entry for the Debian box you are adding which would probably require you to engage IT (or add a hosts entry for which you might need local admin). Or I guess just use the IP address...

  • OK but the Windows machines can still access the share using SMBv2 while the DOS box uses SMBv1. I thought Microsoft had turned off SMBv1 in recent updates, and was expecting other sites that have this (DOS) machine, and a share hosted on a Windows box to suddenly experience breakage but to the best of my knowledge there has been no problem. – Rodney Nov 18 '17 at 13:38
  • Ah yes, you're right - I was thinking as though the share was hosted on Windows for some reason. – Mintra Nov 20 '17 at 9:13

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.