Difference between revisions of "Configure SMB"

From Organic Design wiki
m
({{legacy}})
 
(34 intermediate revisions by 2 users not shown)
Line 1: Line 1:
 +
{{legacy}}
 
{{procedure
 
{{procedure
|description = '''(Incomplete)''' This procedure defines the steps required to set up a shared file directory over the Internet. The share should require authentication and be carried out over a secure connection.
+
|description = The most convenient way for a user to managing their online files is through the standard filing system interface in their local desktop environment, i.e. as a normal file share. Because it's available via the Internet, it needs to be a secure solution. We have two methods of setting up this kind of secure access to users files which are described in this procedure.
 
|role = sysop
 
|role = sysop
 +
|status = in use
 
}}__NOTOC__
 
}}__NOTOC__
  
After doing some research, it seems that the most popular and reliable way of achieving an internet-based file share is using [[w:Samba (software)|Samba]] over a [[w:VPN|Virtual Private Network (VPN)]]. [[w:WebDav|WebDav]] have turned out to be unreliable and temperamental.
+
Here's an example of our samba configuration format for the '''/etc/samba/smb.conf''' file:
 +
<source>
 +
[global]
 +
workgroup = Foo
 +
server string = Foo server
 +
wins support = yes
  
== SFTP ==
+
security = user
Another excellent option is [[w:SFTP|SFTP]] which uses existing [[w:SSH|SSH]] authentication to transfer files and there are applications available for Windows which map this connectivity in to the file system like a normal file share. On Ubuntu, SFTP integration with the file system is a standard feature, simply go in to ''Places/Connect to server'', select ''SSH'', fill in the authentication details and the resource will be mounted as usual.
+
encrypt passwords = yes
 +
password level = 3
 +
passdb backend = tdbsam
  
Unfortunately, the Windows client setup isn't quite as simple as the Ubuntu case, but there is a good application for integrating SFTP in to the FS called [http://dokan-dev.net Dokan]. There are a few other components to install onto the Windows machine before it's ready to map SSH drives as follows:
+
invalid users = root daemon bin sys mail sshd bind www-data
*Install the Microsoft .Net framework starting [http://www.microsoft.com/downloads/details.aspx?familyid=333325FD-AE52-4E35-B531-508D977D32A6&displaylang=en here] (63MB)
+
browseable = yes
*Install the [http://www.microsoft.com/downloads/details.aspx?familyid=200B2FD9-AE1A-4A14-984D-389C36F85647&displaylang=en Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)]
+
writable = yes
*Download and install the main ''Dokan'' library from the [http://dokan-dev.net/download Dokan downloads page]
+
create mask = 0777
*Finally download and install Dokan's SSH support (''Dokan SSHFS'') also from the [http://dokan-dev.net/download Dokan downloads page]
+
directory mask = 0777
  
== Samba over VPN ==
+
[staff]
This is basically just a normal Samba installation which is included in the [[install a new server]] procedure. Once a [[w:VPN|VPN]] has been set up with the [[install a new VPN]] procedure, all the workstations which are connected to the same VPN connection form part of a "virtual LAN" and they can all publish and use resources shared in that LAN such as shared directories, printers and services. They all show up in the normal "network places" or equivalent even though the hosts can be located in diverse locations around the internet, and all these connections are encrypted and secure.
+
path = /shared/staff
*To ensure that Samba ports are only exposed to the private VPN side, set the ''interfaces'' directive in ''/etc/samba/smbd.conf'' to ''tun0''.
+
comment = Our staff files
 +
valid users = henry alan tabatha
 +
</source>
 +
*'''password level = 3''' means account ''foo'', ''Foo'' and ''FOO'' are all equivalent user names
 +
*'''log level = 4''' can be used to debug authentication and other problems, also directing at a single log file can help (instead of one per user)
 +
*'''passdb backend = tdbsam''' means use the basic password backend instead of the older ''smbpasswd'' format or scalable ''ldapsam''
 +
*'''Note:''' whatever password backend is used, ''smbpasswd'' needs to be run for each user before they can begin accessing shares
 +
 
 +
== Account synchronisation ==
 +
The main issue with the initial configuration of Samba on the LAN server concerns the users and groups. What is the origin of the user/group information? and how does samba synchronise to it or use it to authenticate? Since all our servers run a wiki we decided to make the wiki the source of the users, passwords and groups information. To do this we instruct the local wiki daemon to set the unix and samba passwords whenever one is changed in the wiki. All this requires is to install the [[Extension:EventPipe|EventPipe extension]] on the server's administration wiki and ensure that it has a [[wikid.pl|wiki daemon]] configured and running.
 +
*Later we need to only synchronise accounts that are in a particular wiki group
 +
*Later we should also allow the shares to be created and configured through FS records
 +
 
 +
== Next steps ==
 +
*You may want to [[configure VPN]] remote access to the smb shares
 +
 
 +
== See also ==
 +
*[http://mercury.chem.pitt.edu/~sasha/LinuxFocus/English/March2002/article177.shtml Configuration tutorial]
 +
*[http://oreilly.com/catalog/samba/chapter/book/ch06_02.html Controlling access to shares]
 +
*[http://oreilly.com/catalog/samba/chapter/book/ch06_03.html Authentication security]
 +
*[http://oreilly.com/catalog/samba/chapter/book/ch06_04.html Passwords]

Latest revision as of 21:25, 3 June 2018

Legacy.svg Legacy: This article describes a concept that has been superseded in the course of ongoing development on the Organic Design wiki. Please do not develop this any further or base work on this concept, this is only useful for a historic record of work done. You may find a link to the currently used concept or function in this article, if not you can contact the author to find out what has taken the place of this legacy item.
Procedure.svg Configure SMB
Organic Design procedure

Here's an example of our samba configuration format for the /etc/samba/smb.conf file:

[global]
	workgroup = Foo
	server string = Foo server
	wins support = yes

	security = user
	encrypt passwords = yes
	password level = 3
	passdb backend = tdbsam

	invalid users = root daemon bin sys mail sshd bind www-data
	browseable = yes
	writable = yes
	create mask = 0777
	directory mask = 0777

[staff]
	path = /shared/staff
	comment = Our staff files
	valid users = henry alan tabatha
  • password level = 3 means account foo, Foo and FOO are all equivalent user names
  • log level = 4 can be used to debug authentication and other problems, also directing at a single log file can help (instead of one per user)
  • passdb backend = tdbsam means use the basic password backend instead of the older smbpasswd format or scalable ldapsam
  • Note: whatever password backend is used, smbpasswd needs to be run for each user before they can begin accessing shares

Account synchronisation

The main issue with the initial configuration of Samba on the LAN server concerns the users and groups. What is the origin of the user/group information? and how does samba synchronise to it or use it to authenticate? Since all our servers run a wiki we decided to make the wiki the source of the users, passwords and groups information. To do this we instruct the local wiki daemon to set the unix and samba passwords whenever one is changed in the wiki. All this requires is to install the EventPipe extension on the server's administration wiki and ensure that it has a wiki daemon configured and running.

  • Later we need to only synchronise accounts that are in a particular wiki group
  • Later we should also allow the shares to be created and configured through FS records

Next steps

See also