Setup secure samba server

Note that starting from version 4. Samba server is available to install from the default Ubuntu repositories using the apt package manager tool as shown. Once samba server installed, now its time to configure samba server as: unsecure anonymous and secure file sharing.

Important : Before moving any further, ensure that the Windows machine is in the same workgroup which will be configured on the Ubuntu server. Once you know your Windows workgroup its time to move ahead and configure samba server for file sharing. Note : Use the ifconfig command to get your Ubuntu server IP address. Then open the Anonymous directory and try to add files in there to share with other users.

Samba user accounts are separate from system accounts, however, you can optionally install the libpam-winbind package which is used to sync system users and passwords with the samba user database.

You may get the error below, if not proceed to the next step. Try to access the server using its IP address, e. Then enter the credentials username and password for user aaronkilik and click OK. You can securely share some files with other permitted users on the network by dropping them in this directory. Run the commands below specifying your network address.

In this guide, we showed you how to setup Samba4 for anonymous and secure file sharing between Ubuntu and Windows machines. Samba has a long list of configuration options that allow you to fine-tune security to exactly what you need. Here are some of the important options which you can use to make Samba available to valid users and nearly impervious to everyone else. Passwords Most security is based on passwords. A user name and password pair is still one of the best ways to authenticate a user, that is, as long as the password remains safe.

This can be a difficult task with the proliferation of network monitoring tools that are both easy to get and easy to use.

Sniffing a password off the wire has become a relatively trivial task. Limiting password transmission on the network Although transparent to the user, there are several ways in which Windows will transmit and receive a password. Up until Windows Service Pack 3, clear text was one of those options. Basically, the username and password were packaged and transmitted without protection across the network. The first step is to set the Encrypted Passwords global option to Yes.

This will cause Samba never to use clear-text passwords. Where to get your passwords Once you know that the passwords are securely transmitted, you can move on to policy issues. Samba is flexible enough to allow you to use the local UNIX server, a stand-alone Windows server, a Windows domain, or an LDAP server to tell it which clients should and should not be allowed to connect to the server. In short, be careful of which systems you allow your Samba server to trust.

By using an existing username and password infrastructure, you can make Samba play nice with existing infrastructure. Blank passwords Perhaps it goes without saying that allowing your users to use blank passwords opens you up to a whole host of potential problems, but many organizations still allow blank passwords. Samba lets you encourage users to select a password by allowing the administrator to prevent users with blank, or null, passwords from connecting. One of the simplest fixes in this case is to use the 'hosts allow' and 'hosts deny' options in the Samba smb.

An example might be:. The above will only allow SMB connections from 'localhost' your own computer and from the two private networks All other connections will be refused connections as soon as the client sends its first packet. The refusal will be marked as a 'not listening on called name' error.

By default Samba will accept connections on any network interface that it finds on your system. This may not be what you want. The name you will need to use depends on what OS you are using. In the above I used the common name for ethernet adapters on Linux. In that case no Samba code is run at all as the operating system has been told not to pass connections from that interface to any process.

Many people use a firewall to deny access to services that they don't want exposed outside their network. This can be a very good idea, although I would recommend using it in conjunction with the above methods so that you are protected even if your firewall is not active for some reason.