Creating SAMBA Shares and Security
September 2, 2008 1:10 am VM, Vm Desktop, Gentoo, Linux, Computer Security, Linux
So why do I want to share out Samba Shares. This is for VirtualBox, to increase the speed of writing, and also to keep VirtualBox disks small as they can be a bit of a pain to compress.
So to start things off you need to make sure that Samba is on the system. If you have installed Samba before then that is great, if not then this is your chance to emerge it.
After Samba is emerged we need to modify the configuration file. By default there is no configuration file in /etc/samba but there is an example file that can be copied over. For me I copied the file over, but since it is huge I am only going to cut out the pertinent parts and explain them.
First in the [global] settings we have the following.
[global]
workgroup = <my_Workgroup>
server string = Commodore 64
printcap name = cups
load printers = yes
printing = cups
log file = /var/log/samba/log.%m
max log size = 1000
hosts allow = 10.100.210.
security = user
encrypt passwords = yes
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
interfaces = 10.100.210.1/24
Yes I know it can be confusing so now for some explanation on this!
The first line workgroup = sets up the workgroup you want to use. By default Windows leaves it as “Workgroup” - I really hate that, so I make it my own name.
The second line “server string = Commodore 64″ is me having fun with people that I allow access. It really spooks them when they see that Comment in their windows browsing and I usually get a follow up phone call or an E-mail.
The next few lines is to allow printers and other things to work.
The Line: hosts allow = 10.10.10. is where the “magic” starts. Think of it as a basic allow list for your windows browsing. Here I specify that 10.10.10.0/24 can connect to my system (before you ask, no I do not have that on my system, I am a security person, I change everything!). If you want to add more hosts or network to the list it is simple just separate them using spaces.
The next two lines specify the security of the system. I use simple passwords and encryption via these two lines:
security = user
encrypt passwords = yes
If you want to use something else you will need to reference Samba web page here!
The last line in this configuration is interfaces = 10.10.10.1/24 in this line I bring up the interface only on particular port. I am using this for Virtual Box, so I only specify the Virtual Box IP interface here. Once again if you want to bring this up on more then one interface, please specify them using space separation and nothing else.
Now for the sharing of a folder for VirtualBox. Here is an example configuration that gets pasted at the bottom of the smb.conf
[VBoxShare]
comment = VirtualBox Directory Share
path = /some/directory/with_permissions
valid users = user1 user2 user3
public = no
writable = yes
printable = no
create mask = 0770
directory mask = 0770
So if we start here, this is a share that we can name anything you want. For the Patch just specify a common path that all users can access. I recommend creating some directory in /home like /home/virtualbox and assigning the group for virtualbox users to that directory. Make sure to change the permissions to be Read/Write/Execute for the group to that directory.
Valid users is just a list of users that we will create shortly. Public, meaning that it can be seen by everyone. We definitely want it writable so that we can use it as a true directory. The Create mask is the mask that all the files in that directory are created, and the directory mask is for directories. Since we have potentially a whole group writing to this directory you can assign the modes appropriately on a user or group basis.
Now for some other steps!
To create users just issue the following command:
smbpasswd -a <username>
This will create and encrypt the username for samba.
The last step we will need is to restart samba for the settings to have an effect and off you go!
As always, if you have any recommendations, suggestions, etc. Please let me know as two heads are better then one!
Site Search Tags: gentoo, linux, samba, windows, security, setup, isolation, accesslist, access, list, users, virtual, system, virtualbox, sifs, shares
Copyright (c) by BlueKnight

Subscribe to RSS Feed
