We have a SAMBA share on a centos 6 machine.
Question: Can we mount this SAMBA 3 share over the internet? (without VPN/SSH tunnel, so directly!)
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
It depends on some aspects of the protocols and implementations. NetBIOS/NetBEUI is not routable at all and it works sending broadcasts. Workgroups, domain joining, browsing, hostname update and other features of the SMB suite will be restricted to your network due those limitations. It shall work in a local network environment but not over TCP/IP. However, to overcome this issue, NBT (NetBIOS over TCP/IP) and WINS servers where implemented so, things like hostname updates could be done on larger networks where routing is needed.
SMB itself is just an upper-layer protocol (presentation & application), and it will consume lower-layer protocol (network, transport, session) services. It will work across networks, but it heavily depends on the implementation/version of SMB you are using, and the operating system.
tl,dr; It's better to use other protocols like WebDAV, sftp, scp or ftp.
Yes, I once successfully accessed a Samba share over the Internet by enabling 4 ports in the firewall: 137, 138, 139, 445
Obviously, it was a test system. Don't try this at home. Samba is something that should not be accessible from the public Internet.
Instead, you could just use SSH (as suggested). FTP isn't that much better as it's not encrypted by default.
With the right ports open on the firewall then one could mount and access a cifs/smb share over the internet. Just look at the smb share opened at \live.sysinternals.com\Tools for example.
One should never open samba to an untrusted network since a lot of malware and infosec tools can use smb as an attack vector. Because of this one really should use sftp with chroot jails, fail2ban, and pubkey only authentication.
Honestly, I would strongly suggest looking into using iscsi luns or nfsv4 and ipsec to access one's remote storage over a secured vpn instead of using samba.