Ako namapovať disk z Linuxu pod Windows aby to bolo secure?

[Jezevec]

Zeby ? http://support.microsoft.com/kb/324055

Jestli to funguje nevim jen sem zagooglil, podle vseho by melo na XP pro, na home nikoli.

[svaca]

XP home ale NENI operacni system .. je to total shit ...
XP prof je tak na puli cesty ....

[Gargamel]

Zeby ? http://support.microsoft.com/kb/324055

Jestli to funguje nevim jen sem zagooglil, podle vseho by melo na XP pro, na home nikoli.

Windows Services for Unix je trochu bumbrlicek se slozitou konfiguraci - zacatecnik bude zmaten mapovanim UID/GID, konfiguraci NIS a podobne. Navic to neni rozumne integrovane. Proste typicky dalsi zpraseny produkt MS.

[Lukas L.]

sice nejsem vubec expert na LM 1/2, NTLM, NTLM2 (http://davenport.sourceforge.net/ntlm.html) a implementaci Sambe, ale kde jsi (e1) vzal, ze samba posila hesla v plain textu ? Jen pro test jsem ted proti svoji Samba 3.0.30 PDC ((s)LDAP backend) vzal wireshark z WinXP a vidim normalni NTLM challenge/response.

Na druhou stranu si myslim, ze vystavovat sambu/windows sharing do internetu neni dobry napad. Resenim (ktere jsem po pravde nezkousel, protoze to nepotrebuji) je protahnout to SSL tunelem jak pise Fox!MURDER. Jeste me nepada, ze byste si ty data mohli stahovat lokalne pracovat a pak vratit zpet - samozrejme podle povahy dat a prace nad nima. Jinak - ja tohle resim normalnim VPN spojenim (pod Windows 2k3 srv) a pak normalnim namapovanim \\abcd\slozka na sitovy disk.

[e1]

Už sme sa rozhodli, na 99% to bude riešené Sambou cez VPN. Žiaľ ešte nebol čas hrajkať sa tým lebo teraz riešime niečo iné, ale dostaneme sa aj k tomu a potom zreferujeme.

[e1]

Takže máme rozchodenú Sambu cez OpenVPN, ale máme jeden problém. Rýchlosť, resp. pomalosť. Dosahujeme rýchlosť cca. 6Mbps download (upload zatiaľ je ok), napriek tomu že moje domáce pripojenie je 20/2Mbps, server má gigabitovú prípojku, a HW na oboch stranách má dostatočný výkon na šifrovanie. Dosahované rýchlosti sú +/- rovnaké aj u kamoša. Ja používam Vistu 64-bit a som za routrom, kamoš má jabĺčko a má verejnú IP na intráku. Máte nejaký nápad že prečo máme tento problém? Server je Gentoo, cez FTP/HTTP dosahujeme bez problémov aj 10x väčšie rýchlosti.

[Fox!MURDER]

Takže máme rozchodenú Sambu cez OpenVPN, ale máme jeden problém. Rýchlosť, resp. pomalosť. Dosahujeme rýchlosť cca. 6Mbps download (upload zatiaľ je ok), napriek tomu že moje domáce pripojenie je 20/2Mbps, server má gigabitovú prípojku, a HW na oboch stranách má dostatočný výkon na šifrovanie. Dosahované rýchlosti sú +/- rovnaké aj u kamoša. Ja používam Vistu 64-bit a som za routrom, kamoš má jabĺčko a má verejnú IP na intráku. Máte nejaký nápad že prečo máme tento problém? Server je Gentoo, cez FTP/HTTP dosahujeme bez problémov aj 10x väčšie rýchlosti.

dojdu si pro vesteckou kouli a zjistim jak to mas nakonfigurovany, pak se ozvu ...

[e1]

OpenVPN server:

# allspark

port 1194
proto udp

dev tun

ca allspark/ca.crt
cert allspark/server.crt
key allspark/server.key
dh allspark/dh2048.pem

server 10.10.3.0 255.255.255.0

ifconfig-pool-persist ipp.txt

keepalive 10 120
comp-lzo

user nobody
group nobody

persist-key
persist-tun

cipher AES-256-CBC

status /var/log/openvpn-status.log

verb 5

OpenVPN klient:

##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server.     #
#                                            #
# This configuration can be used by multiple #
# clients, however each client should have   #
# its own cert and key files.                #
#                                            #
# On Windows, you might want to rename this  #
# file so it has a .ovpn extension           #
##############################################

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun

# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one.  On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap

# Are we connecting to a TCP or
# UDP server?  Use the same setting as
# on the server.
;proto tcp
proto udp

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote allspark.info 1194
;remote my-server-2 1194

# Choose a random host from the remote
# list for load-balancing.  Otherwise
# try hosts in the order specified.
;remote-random

# Keep trying indefinitely to resolve the
# host name of the OpenVPN server.  Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nobody

# Try to preserve some state across restarts.
persist-key
persist-tun

# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here.  See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]

# Wireless networks often produce a lot
# of duplicate packets.  Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings

# SSL/TLS parms.
# See the server config file for more
# description.  It's best to use
# a separate .crt/.key file pair
# for each client.  A single ca
# file can be used for all clients.
ca D:/Documents/keys/ca.crt
cert D:/Documents/keys/e1.crt
key D:/Documents/keys/e1.key


# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server".  This is an
# important precaution to protect against
# a potential attack discussed here:
#  http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server".  The build-key-server
# script in the easy-rsa folder will do this.
ns-cert-type server

# If a tls-auth key is used on the server
# then every client must also have the key.
;tls-auth ta.key 1

# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x

# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo

# Set log file verbosity.
verb 3

# Silence repeating messages
;mute 20

cipher AES-256-CBC

Samba:

# allspark

[global]
workgroup = allspark
netbios name = allspark
server string = allspark.info

load printers = no
lanman auth = no
encrypt passwords = yes
preserve case = yes
short preserve case = yes

interfaces = 10.10.3.1/24
bind interfaces only = yes
hosts allow = 10.10.3. 127.
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 IPTOS_THROUGHPUT

browseable = yes
writeable = yes
create mask = 0644

# Name Resolution Options
name resolve order = wins lmhosts host bcast
wins support = yes
wins server = 127.0.0.1
wins proxy = yes
dns proxy = no

log file = /var/log/samba/log.%m
max log size = 50
; log level = 3

[e1]
comment = Home directory
path = /home/e1/
valid users = e1
writable = yes
browseable = yes