Make a network drive available over the internet?

19

13

I recently built a small server machine, using Ubuntu Server and Samba, to act as a file server (among other things) so that my entire family can access certain files over the network from Windows machines. However, I would love to take this a step further and have the shares be accessible over the internet, away from home. How would I do this? I know very little about how the Windows network shares system works, so I have no idea where to start.

Sasha Chedygov

Posted 2011-07-17T20:28:13.440

Reputation: 6 616

zerotier is the way to go. – fie – 2019-05-09T21:37:45.430

For anyone reading this question in 2019 and beyond, I ended up deciding against this—partially because my ISP blocked the SMB ports, but mostly because, like others here have said, it's just a bad idea from a security standpoint. At the time I ended up renting a server and using SCP to upload files + nginx to serve them, which worked well enough. I've since switched to using Syncthing for these sorts of things, which is way easier to use and manage, especially for non-technical folks.

– Sasha Chedygov – 2019-05-10T19:54:26.917

You really should use SCP. – kzh – 2011-07-17T21:53:35.170

@kzh: That's a little too complex for some of my family members. – Sasha Chedygov – 2011-07-17T21:55:09.547

WinSCP has Win Explorer integration: http://winscp.net/eng/docs/integration

– kzh – 2011-07-17T21:57:27.257

@kzh: Well the whole point is to avoid having to install software to get it to work. Without that constraint, I would just use a VPN. – Sasha Chedygov – 2011-07-17T22:01:06.440

It's possible to carry WinSCP on a pendrive - preconfigure it for "easy" mode, give .exe/.ini to users. – user1686 – 2011-07-17T22:07:16.420

1Nothing personal regarding the accepted answer, but while that may have technically answered your question, I would NEVER do this. You are really exposing yourself, especially if you have anything sensitive on your network. I would say the right way is to set up a simple PPTP VPN for your family to connect to, and then let them have access. – KCotreau – 2011-07-17T22:50:33.857

1@KCotreau: There is a lot more to this question that I left out for the sake of simplicity. Let's just say that the data that we will be exposing is not in any way sensitive. I understand and accept the security risks--I just wanted a simple answer to my specific question. – Sasha Chedygov – 2011-07-18T00:39:38.063

1@musicfreak My concern is that it is a point of attack into other areas of computer, or even network as a whole. Obviously, you are free to do it however you want, but I still don't recommend it unless there is nothing on the computer, at least, not just the share. A very cool book is "Hacking Exposed". It shows just how much hackers attack these protocols. – KCotreau – 2011-07-18T00:51:03.583

Answers

13

With Samba, you would have to expose ports 139/tcp and 445/tcp to the outside – usually this involves configuring "port forwarding" in your router. Additionally, you must make sure that your external IP address is pingable from the outside.

After this, you'll be able to access the shares by entering \\youraddress in Explorer's address bar or in Start - Run. (Here youraddress is either your external IP address or your DNS name, if you have one.)

Note, however, that the CIFS and SMBv2 protocol used by Windows file sharing does not provide data encryption (so anybody with a packet sniffer can monitor your file transfers), and its authentication is not especially strong either. Only SMBv3 gained encryption support.

Also, don't forget that the Windows' SMB service has in the past been a very frequent infection target. While most Windows exploits do not affect Samba in any way, this is still worth remembering (and often means that the SMB ports get blocked at ISP level).

Also note that Windows machines by default remember the login credentials for the entire local session. Unless you're connecting to Samba as "Guest", you must take special care on public machines: always use net use \\address before opening in Explorer / net use \\address /del to disconnect. (This is not needed on personal computers.)

For some extra security, add the following to general section in smb.conf:

LANMAN auth = no
NTLM auth = no
invalid users = root

user1686

Posted 2011-07-17T20:28:13.440

Reputation: 283 655

I know i'm late to the game, but if anyone's still around: does this still work? I tried setting up a DMZ- so all ports should be forward, and could not connect to the share... – Blaine – 2017-06-06T14:25:29.097

@Blaine It seems as though most residential ISPs block these ports, so there is nothing you can do in that case. – Sasha Chedygov – 2019-05-10T19:56:35.610

Huh, I figured it would be much more complex than that. Thank you for the advice! – Sasha Chedygov – 2011-07-17T21:48:21.823

2On a side note, do you have any recommendations for making the lack of data encryption less of an issue? I trust all of the networks I connect to, but I might want to, for example, make an account for my girlfriend (who may be on a non-trustworthy network), so she can access my music/photos/etc. I could always just give her a read-only account and call it good, but I'm just wondering if you have some more specific advice perhaps. Thanks again! – Sasha Chedygov – 2011-07-17T21:52:13.900

For read-only access, you could set up a HTTPS server (StartSSL/CAcert). To upload files, this could be extended to WebDAV...but Windows won't use WebDAV if CIFS is available, and most Windows versions have some problems with SSL-secured WebDAV. Other solutions require external software (SFTP using WinSCP) or even VPN configuration. – user1686 – 2011-07-17T22:02:23.423

Well I was planning on setting up a version-based backup system (sort of like Time Machine on Mac OS X), so that even if someone got access to the shares and wiped everything, it would still be safe. Do you think this is enough? I would, of course, prefer to prevent something like this from happening in the first place. – Sasha Chedygov – 2011-07-17T22:05:37.503

Ahhh, okay, your last comment is what I was looking for. Thank you again! – Sasha Chedygov – 2011-07-17T22:06:23.960

We don't store any sensitive information on there, so I'm a lot more worried about the data getting wiped than revealed. – Sasha Chedygov – 2011-07-17T22:35:00.680

2Just a note: with Canadian ISPs, the SMB ports are blocked unless you have a business account. Make sure your ISP unblocks the ports if you're using JUST SMB – Canadian Luke – 2011-07-18T00:29:00.023

8

If your family can handle using WinSCP then:

  • install and setup SSH
  • give your family members local accounts on your server
  • symlink your file store into these directories. For example, if you are exposing /srv/samba_files through Samba, you'd want to do an ln -s /home/{user}/files /srv/samba_files or similar for each account. If you have to do this for many accounts you could write a script to do it.
  • install WinSCP on your family's computers

You'll then have a very secure method of transferring files that isn't too difficult to use.

However, if you really want the "network drive" integration with Windows, I'd learn about OpenVPN and then setting up a bridged tunnel to your home network. I've successfully gotten Windows fileshares to work over such tunnels.

You can also use PoPToP (pptpd) to allow a Windows system to connect back to your Ubuntu box via a PPTP vpn. (An IPSec/L2TP tunnel would provide better security but it is difficult to setup).

LawrenceC

Posted 2011-07-17T20:28:13.440

Reputation: 63 487

@LawrenceC Is this "openvpn" method sharing heavyweight for single board computers like raspberry pi ? – Bhavesh Gangani – 2016-06-26T18:42:49.890

OpenVPN took 20% CPU on an ARM 1.3Ghz system and didn't run me low of 512mb RAM. This was also functioning as a router, DHCP and DNS server. Some SOHO routers with less specs run it. It should be fine but will consume some resources. – LawrenceC – 2016-06-26T19:34:32.510

Why not just create a files share pointing to /srv/samba_files directly? – user1686 – 2011-07-17T21:59:44.513

Samba shares would only be visible on the LAN side. On the Internet side you would use WinSCP. – LawrenceC – 2011-07-18T00:21:05.763

1

It depends on what kind of files you intend to serve. If these are documents, or just files you need to access remotely, just run an FTP server on your Ubuntu server. Make sure you secure it well, with good passwords, and access to just the file directory, and not the root.

If however you intend to stream media files (songs, movies), you're looking at running a streaming server. There are plenty of solutions for that (here's one).

Finally, you could always use an existing "cloud" drive solution like Dropbox or SkyDrive, or Amazon Cloud Player - just synchronize your files with one of those services and internet access (a speedy one at that) is guaranteed.

Traveling Tech Guy

Posted 2011-07-17T20:28:13.440

Reputation: 8 743