I run a Samba 4 instance at a small private school. This makes a regular Linux server appear as a directory controller. There are two relevant benefits to this:
- I have a Samba share for people's documents, and I use the Redirected Folders feature to allow any employee to sit down at any PC, log in with their domain credentials, and their My Documents points to network storage.
- Everyone has a mapped drive (using Group Policy Preferences) to a share specific to their account type. Students can access one share (one share for all students), teachers have another, and office staff have another.
However, I would like to allow BYOD (Bring Your Own Device). Some employees are already asking for it with their personal laptops, and I know eventually most everyone will want to.
Is there any way to replicate the two features above without having to join PCs to the domain? Joining personal PCs is impractical if only because only professional editions of Windows support this.
Ideally, any operating system (including mobile) could access the relevant shares, but of course Windows is key. Offline caching is optional. (I could set up OpenVPN for teachers who want to access their files from home.)
The problem with simply giving SSH access to the relevant shares is primarily that Samba 4 relies on ext4 ACLs and ext4 extended attributes to maintain NTFS permissions. Writing files directly to the Linux server would bypass this and would (probably) not be interoperable with Samba4.
Right now I am completely flexible. I am even fine with scrapping the whole domain and using some other software for the two features above.
How can I allow school employees and students freedom to securely share files without requiring everyone to have specific editions of Windows?
Best Answer
Why not take another route. Have them use VPN from their own devices. The proper way would be to allow them wirelessly on a guest network and have the vpn to access relevant sources. With this you can protect your network from untrusted devices. Trust me the last thing you want to do is run around and figure out who's laptop is generating suspicious traffic.
Once they are connected to the VPN they can map the network drives with their directory credentials.
Cheers, Dexter