1

I am using QEMU/KVM for virtualization of various guest systems and Samba to provide an exchange folder (shared-folder) between the host-OS and the guest-OS.

Now I want to protect this Samba-provided shared folder against foreign access. It should be accessible only by QEMU-virtualized guests, but not for other third party people in the same network.

My current configuration in /etc/samba/smb.conf looks like that:

[global]
workgroup = WORKGROUP
security = user
map to guest = Bad User
server string = %h server (Samba, Ubuntu)
dns proxy = No
wins support = Yes
usershare allow guests = Yes
panic action = /usr/share/samba/panic-action %d
lanman auth = no
ntlm auth = no
follow symlinks = yes
wide links = yes
load printers = no
disable spoolss = yes

[Shared]
comment = Shared Folder for QEMU
path = /home/myusername/Exchange
public = no
browseable = yes
writeable = yes
read only = no
guest ok = yes
force user = myusername

Now the central question is:

Do you have any recommendations how I could implement such a security hardening feature?

Thank you very much!

|improve this question
1

Bind your samba to the virtual interface between guest VM and host. Edit smb.conf and add below lines

bind interfaces only = yes
interfaces = lo br0
|improve this answer
  • Should I insert your lines in the [global]-section or in the [shared]-section? And do I need my huge configuration at all? Maybe it is already enough to only specify the name of the workgroup in workgroup = WORKGROUP, but no need to put the rest? – Dave Jan 19 '18 at 8:21
  • [global] section. I am not sure about workgroup, looks like you need nmbd to make it work. askubuntu.com/questions/23568/… – rajaganesh87 Jan 19 '18 at 8:24
  • 1
    Thanks a lot! Binding the share to specific interfaces is seriously a great option! – Dave Jan 19 '18 at 8:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.