How to mount home as a samba share

server-message-block

It seems that I have missed out on something fundamental on how I can mount a home smb-share on a linux client used by many users. This isn't a problem with NFS – I have mounted /home/users/ on all clients, so that /home/users/user-a and /home/users/user-b will find their homedir then they log on. But how do I do this with SMB? I should mount /home/users in fstab – because I'll have to mount this SMB-share with a defined users rights, and that won't work as several users dir where they find their homedir.

AutoFS? A login script when the user log on? Isn't this automated in any of the linux distros? What have I missed out on?

I have the 389 Directory Server, 800 users and two file servers for the homedirs (active users…) and I use NFS – but I'm thinking about using SMB instead of NFS, but I really don't know how to mount the homedir for each user.

Best Answer

I think autofs would be the best solution here; but in all honestly if you have the option of going with NFS I don't see any reason to use SMB. NFS is problematic enough as a home directory because of some programs with bad locking mechanisms and various complications. On a file system that is missing many of the basic posix file system properties you will only make this worse.

While autofs could be configured to mount any given home directory via smb at the time access was requested and with separate mounts for each user, I would suggest that the reason there is not an obvious way to set this up is because it is inherently a problematic arrangement.

Can you just setup mounts INSIDE the users 'nix home directory so that they have access to their windows resources without making that resource their home directory? Can you use an NFS server for the home directories and then have automated mounts inside that for a two layered approach?

Related Solutions

Port forwarding for samba

The minimum needed to access Windows or Samba shares over a network is port 139 TCP - I've used this to tunnel Samba connections through SSH connections a number of times.

SMB is not an encrypted protocol as you have already found, so I strongly recommend against opening it to the outside world directly instead of allowing users to connect via a secure tunnel such as that provided by SSH or some form of more general VPN. I believe that the authentication method used is safe to perform in the plain (it is a challenge response arrangement that doesn't require plain text credentials to be transferred) so if you can guarantee that content on the shares is not sensitive you can get away with not using a tunnel/VPN but I would still recommend it as an additional level of security if only so that you can control who has access remotely separately from those who have access at all. Also a SSH tunnel or VPN can support compression which will reduce bandwidth requirements when the shares are accessed remotely.

There have been no successful unauthenticated remote attacks reported against Samba in my recent memory, so you are probably safe from that point of view, though again I'd suggest tunnelling the protocol instead of opening it plain. Having port 139 and others open will be an invitation to try if any remotely exploitable issues are found.

Another serious issue will be user password security. If the service is open and a user has an insecure password (either not complex enough, or something guessable by a cracker, and so on) then you have a serious problem. So you need to make sure you have a good password policy in place. Using a VPN like OpenVPN will mitigate this somewhat as people will need to have a keyset for the VPN too, though you can't guarantee that a user will keep their private key safe either...

Nfs – Mount Mac OS X 10.7 share on CentOS

Mounting an SMBX share from Lion on Linux requires a CIFS kernel module with NTMLSSP support. CentOS 5.2's kernel doesn't have it, so mounting via smb/cifs (mount -t cifs) won't work with SMBX no matter what you do. That is, of course, unless you recompile a newer kernel which I assume you wouldn't want to. That doesn't leave you with much in the SMB/CIFS realm that leaves a static mount. Alternatively, you can run a separate instance of SAMBA on Lion that is not SMBX: SMBUp or via MacPorts.

As far as NFS goes, your UID's have to be the same between the boxes. Most likely, except on managed systems designed to use NFS, this is not the case. Easiest way to check is to do ls -l /Test on Lion, see who owns the directory, then do id user. Example:

> id user
uid=110(user) gid=111(users) groups=111(users)

There has to be a user of the same "purpose" on the linux box with the same UID. If there's a conflict (that happens a lot), it won't work.

Best Answer

Related Solutions

Port forwarding for samba

Nfs – Mount Mac OS X 10.7 share on CentOS

Related Topic