3

I just have encrypted my home folder and all of its subfolders. One of the subfolders was configured as a Samba share:

[avo-home]
    comment = Avo's Home Share
    path = /home/avo/share
    browsable = yes
    read only = no
    create mask = 0660
    directory mask = 0770
    valid users = avo

Now I noticed that this share is available from Windows only if I logged in on my Ubuntu server with SSH. Otherwise, I cannot connect to it. Before I encrypted it, it used to be available regardless of the active SSH session.

How to make this encrypted share available to Windows clients without having to log in with SSH?

1 Answer 1

4

There are several potential solutions to this. The question is: does this folder need to be encrypted, or not?

Not encrypted

If it does not need to be encrypted, the easiest solution is the following:

move the folder to /var/avoshare:

sudo mv /home/avo/share /var/avoshare

Set up a soft link

ln -s /var/avoshare /home/avo/share

Then update your config to

[avo-home]
comment = Avo's Home Share
path = /var/avoshare  

Encrypted using full disk encryption

Ubuntu's full disk encryption solves your problem. Disadvantage: you need to do that at installation time I believe, so you have to set up your server again.

Encrypted using loopfs

Use an encrypted loopfs for the /var/avoshare folder. Note: most of the commands require root priviledges. Make sure to give avo ownership of the mounted filesystem at the end.

  1. use dd to create a file of size you need. Store the file somewhere, e.g. /var/avoloop

  2. use losetup -e AES /dev/loop0 /var/avoloop to set up a loopdevice for that file

  3. Format the loopdevice with ext4 using mkfs.ext4 /dev/loop0

  4. You can now mount that loopdevice at /var/avoshare. You need to enter a password for that.

  5. For more convenience, write a script to set up the encrypted loopfs, run that script after you boot the server. The script will use losetup -e AES and mount

  6. make sure to unmount /var/avoshare before shutting down the machine. Look here for details.

4
  • Thanks for replying. Actually it needs to be encrypted, in case someone breaks in and steals the physical box. But I still want to be able to access it via Samba using my login and password. Is there any solution to such scenario?
    – avo
    Jul 13, 2014 at 7:28
  • 1
    Hi Avo, I sketched out a solution. Let me know if you need more details.
    – noleti
    Jul 13, 2014 at 22:21
  • @noleti is there a way to make the server store the encryption keys only when there is a client connected, so that the attacker won't be able to access the files if he gets the access to the physical box while server is running but no clients are connected? I could use encrypted folders but this adds an extra layer. May 28, 2018 at 9:43
  • @styrofoamfly It sounds like the original setup was doing exactly that. You had to have an open SSH connection to decrypt the files, which were then available via smb share. I don't know the exact details, but I assume that the keys are not stored on the server in that case.
    – noleti
    Jun 14, 2018 at 5:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .