Limit SMB Share to specific IP?

[HarambeLives]

I have a really weird use case here. I need an SMB share with @Everyone permissions for Veeam Backup for Microsoft 365. For some weird reason it doesn't really support SMB shares as repositories, you must select either object storage (And I couldn't get Minio to work with it either!) or local storage.

You can use use an SMB share if its open to the world, which is the dumbest thing I've ever seen - https://helpcenter.veeam.com/docs/vbo365/guide/br_smb.html?ver=60

So I have a share, open to the world with my O365 data in it (Oh, did I mention its not encrypted?) Not great

Before I just nuke this product from orbit, is there any way to lock down a specific share, to a specific IP? I would be happy if only the box that Veeam runs on could access it

EDIT: I'm sorry @Everyone, I didn't mean to tag you here... oops

 

[winnielinnie]

is there any way to lock down a specific share, to a specific IP?

These are the two important settings in a specific SMB share's options.

 

[HarambeLives]

So when I do the "Hosts Allow", it actually ends up applying to the entire SMB service it seems, all other users for all other shared get dropped

Is that expected?

 

[HarambeLives]

Interesting, on my other box which is more up to date it works! I'm going to update my main box and see if that fixes it

 

[HarambeLives]

Updated to U3.1 and now it works, I guess there was an old bug! Well if anyone else runs into this, update

 

[HarambeLives]

I spoke too soon, now NOTHING can access that share... This option sure is buggy

 

[winnielinnie]

Specifying "Hosts Allow" on a specific share should have no effect on the other shares. You're sure it's not something on the Windows side of things that is acting up? You've confirmed that if you specify "Hosts Allow" on a specific share, then that particular client is the only client that can access any SMB share?

 

[HarambeLives]

I'm going to quickly build a temp Debian box to test with, Windows sure is a fickle beast sometimes

 

[HarambeLives]

Alright, works as intended with a Debian box, so I think we can call this solved. Its clearly a Windows thing