Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

We have a SAMBA share on a centos 6 machine.

Question: Can we mount this SAMBA 3 share over the internet? (without VPN/SSH tunnel, so directly!)

share|improve this question
    
Regardless of feasability, having a Samba3 remotely accessible without VPN is a big "No" security wise... You may instead try to have an OpenVPN connection that makes the remote Samba3 server "appear as if part of your own lan", or make you appear part of its lan (ex: serverfault.com/questions/137933/…). That way, only have the OpenVPN port accessible (via proper authentification), and OpenVPN encryption would also provide privacy and a bit of security for the travelling packets between local and remote. –  Olivier Dulac Jul 8 at 10:53

1 Answer 1

up vote 7 down vote accepted

It depends on some aspects of the protocols and implementations. NetBIOS/NetBEUI is not routable at all and it works sending broadcasts. Workgroups, domain joining, browsing, hostname update and other features of the SMB suite will be restricted to your network due those limitations. It shall work in a local network environment but not over TCP/IP. However, to overcome this issue, NBT (NetBIOS over TCP/IP) and WINS servers where implemented so, things like hostname updates could be done on larger networks where routing is needed.

SMB itself is just an upper-layer protocol (presentation & application), and it will consume lower-layer protocol (network, transport, session) services. It will work across networks, but it heavily depends on the implementation/version of SMB you are using, and the operating system.

The Good:

  • It should work (in theory). Its just a matter of accessing the IP addresses where this share is published. Port redirection is probably needed on your modem or your firewall if you are "directly attached" to the Internet.

The Bad:

  • SMB is not safe at all. VPNs' (IPSec, OpenVPN, PPTP ...) first purpose on this setup is to solve the encryption and security issues of the SMB protocol, not routing ones. Edit: Maybe another layer of security can be added with Server Signing with samba 3.3.x+

The Ugly:

  • Your ISP could be blocking this kind of traffic (445/tcp)
  • SMB does not have any kind of check-summing/verification, and it could have performance issues on high-latency networks.

tl,dr; It's better to use other protocols like WebDAV, sftp, scp or ftp.

share|improve this answer
    
+1 for good answer –  Olivier Dulac Jul 8 at 11:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.