Configure SMB
|
Configure SMB Organic Design procedure |
SFTP
The first method is SFTP which uses existing SSH protocol to transfer files, and the workstations can map this connectivity in to the file system like a normal file share.
- Don't forget that additional users created with adduser' also need to be added to AllowedUsers in /etc/ssh/sshd_config
- We really need to upgrade to openssh-server 4.8 for the chroot-jail option
- Another OpenSSH4.9 chroot example
- Chroot jail with OpenSSH5.0+
Setting up access for Ubuntu workstations
On Ubuntu, SFTP integration with the file system is a standard feature, simply go in to Places/Connect to server, select SSH, fill in the authentication details and the resource will be mounted as usual.
Setting up access for Windows workstations
Unfortunately, the Windows client setup isn't quite as simple as the Ubuntu case, but there is a good application for integrating SFTP in to the FS called Dokan. There are a few other components to install onto the Windows machine before it's ready to map SSH drives as follows:
- Install the Microsoft .Net framework starting here (63MB)
- Note, say "no" to the strongly recommended upgrades, as they're nothing to do with this procedure
- Note, if this one fails, try skipping this one it may already be installed
- Download and install the main Dokan library from the Dokan downloads page
- Finally download and install Dokan's SSH support (Dokan SSHFS) also from the Dokan downloads page
- When you fist run Dokan, you must create a profile for each remote mount you want to connect to. This is so that each ones settings can be selected quickly from the drop-down list by unique name.
Operation
After installed, you should copy the Dokan icon from the start menu/programs menu onto the quick launch on the taskbar so that you can run it at any time with a single click (you can copy an icon from the start menu by dragging and dropping it while holding down the CTRL key).
When you run Dokan, the login form comes up and you must select one of the profiles, enter the password and click connect. An icon for it will then show up in the system tray by the clock.
The icon in the system tray has a right-click menu with two options, exit which closes it down completely, and mount/dismount which allows you to connect and disconnect the drive without needing to re-enter the password.
Samba over VPN
This is basically just a normal Samba installation which is included in the install a new server procedure, but Samba is not a very secure protocol, and so if used to share resources to Internet clients, it must be protected with a VPN and so is probably only the best solution for file sharing if your organisation is already using a VPN to connect remote users into your LAN.
Once a VPN has been set up with the install a new VPN procedure, all the workstations which are connected to the same VPN connection form part of a "virtual LAN" and they can all publish and use resources shared in that LAN such as shared directories, printers and services. They all show up in the normal "network places" or equivalent even though the hosts can be located in diverse locations around the internet, and all these connections are encrypted and secure.
- To ensure that Samba ports are only exposed to the private VPN side, set the interfaces directive in /etc/samba/smbd.conf to tun0.
.jpg){kind=link}
