3 ms·

I’m curious, what do you use to access files on your NAS? I’ve used Samba for forever but it’s always been kind of annoying to deal with permissions, and whilst

by bpye 5y ago

I’m curious, what do you use to access files on your NAS? I’ve used Samba for forever but it’s always been kind of annoying to deal with permissions, and whilst running AD would probably solve that, I then have to deal with running AD. I’m tempted to try switching to NFS instead.

jchw 5y ago
Samba. I tried AD very briefly before realizing how absolutely terrible of an idea it was. It just makes life so complicated, and AD integration was not as good as I was hoping. I can see why this market constantly has all kinds of crazy offerings… As far as permissions go, I guess I am mostly ignoring granular permissions. I’m generally only concerned with permissions on a per-share basis. This way, file permissions mostly don’t matter and can be a one-and-done affair. Then, I can split files up into separate shares. NFS also seemed appealing, but honestly it does seem to bring a lot of complexity that SMB/CIFS does not, and everything supports the latter well enough for my use cases. Remote access is another issue, since you should probably not do SMB over the internet, but I guess that can be solved with Tailscale or ZeroTier.
- jra_samba 5y ago
  SMB3 is secure over the internet. But you really have to make sure it is an encrypted connection. In Samba you do this by adding: server min protocol = SMB3 smb encrypt = required to the [global] section of your smb.conf.
  - jchw 5y ago
    Honestly, I don’t mind a VPN moat on top of even that, but it’s definitely a good tip. Any unencrypted data over a VPN is a liability anyways. That said: for the moment, I still have some SMB1 clients inside my network. Yes, this is terrible, and frankly it is surprising Samba still supports it (I won’t be too surprised or too angry if it gets removed now that it’s separated out.) I should probably segregate SMB1 clients onto a different fileserver on a different VLAN or something. Until then, it would be annoying to force SMB3 on all clients. (As for why Anybody would use SMB1, the answer is retro computing. I also suspect that Open PS2 Loader is an SMB1 client, though I have not checked.)
    - jra_samba 5y ago
      We just (a week or so ago) added the ability to remove it. You can now configure samba with: --without-smb1-server and the SMB1 code is no longer compiled into the binary :-).

by bpye 5y ago

jchw 5y ago

Samba. I tried AD very briefly before realizing how absolutely terrible of an idea it was. It just makes life so complicated, and AD integration was not as good as I was hoping. I can see why this market constantly has all kinds of crazy offerings… As far as permissions go, I guess I am mostly ignoring granular permissions. I’m generally only concerned with permissions on a per-share basis. This way, file permissions mostly don’t matter and can be a one-and-done affair. Then, I can split files up into separate shares. NFS also seemed appealing, but honestly it does seem to bring a lot of complexity that SMB/CIFS does not, and everything supports the latter well enough for my use cases. Remote access is another issue, since you should probably not do SMB over the internet, but I guess that can be solved with Tailscale or ZeroTier.

jra_samba 5y ago
SMB3 is secure over the internet. But you really have to make sure it is an encrypted connection. In Samba you do this by adding: server min protocol = SMB3 smb encrypt = required to the [global] section of your smb.conf.
- jchw 5y ago
  Honestly, I don’t mind a VPN moat on top of even that, but it’s definitely a good tip. Any unencrypted data over a VPN is a liability anyways. That said: for the moment, I still have some SMB1 clients inside my network. Yes, this is terrible, and frankly it is surprising Samba still supports it (I won’t be too surprised or too angry if it gets removed now that it’s separated out.) I should probably segregate SMB1 clients onto a different fileserver on a different VLAN or something. Until then, it would be annoying to force SMB3 on all clients. (As for why Anybody would use SMB1, the answer is retro computing. I also suspect that Open PS2 Loader is an SMB1 client, though I have not checked.)
  - jra_samba 5y ago
    We just (a week or so ago) added the ability to remove it. You can now configure samba with: --without-smb1-server and the SMB1 code is no longer compiled into the binary :-).