1

I am using QEMU/KVM for virtualization of various guest systems and Samba to provide an exchange folder (shared-folder) between the host-OS and the guest-OS.

Now I want to protect this Samba-provided shared folder against foreign access. It should be accessible only by QEMU-virtualized guests, but not for other third party people in the same network.


My current configuration in /etc/samba/smb.conf looks like that:

[global]
workgroup = WORKGROUP
security = user
map to guest = Bad User
server string = %h server (Samba, Ubuntu)
dns proxy = No
wins support = Yes
usershare allow guests = Yes
panic action = /usr/share/samba/panic-action %d
lanman auth = no
ntlm auth = no
follow symlinks = yes
wide links = yes
load printers = no
disable spoolss = yes

[Shared]
comment = Shared Folder for QEMU
path = /home/myusername/Exchange
public = no
browseable = yes
writeable = yes
read only = no
guest ok = yes
force user = myusername

Now the central question is:

Do you have any recommendations how I could implement such a security hardening feature?

Thank you very much!

1 Answer 1

1

Bind your samba to the virtual interface between guest VM and host. Edit smb.conf and add below lines

bind interfaces only = yes
interfaces = lo br0
3
  • Should I insert your lines in the [global]-section or in the [shared]-section? And do I need my huge configuration at all? Maybe it is already enough to only specify the name of the workgroup in workgroup = WORKGROUP, but no need to put the rest?
    – Dave
    Jan 19, 2018 at 8:21
  • [global] section. I am not sure about workgroup, looks like you need nmbd to make it work. askubuntu.com/questions/23568/… Jan 19, 2018 at 8:24
  • 1
    Thanks a lot! Binding the share to specific interfaces is seriously a great option!
    – Dave
    Jan 19, 2018 at 8:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .