SAMBA(cifs) ip filter

[muzhik]

Hey!

I have few shared folders which access restrict by ip, without auth.

But today every folders which have ip settings tell to users that have to insert login\password.
I did not change owner for folders or someting else

How to fix?

 

[dlavigne]

Build version of FreeNAS (from System -> Information)? Client versions?

 

[anodos]

Hey!

I have few shared folders which access restrict by ip, without auth.

But today every folders which have ip settings tell to users that have to insert login\password.
I did not change owner for folders or someting else

How to fix?

Post contents of /usr/local/etc/smb4.conf
Post output of "getfacl /mnt/path/to/share"

Proper authentication is a much better solution than IP filtering.

 

[muzhik]

Build version of FreeNAS (from System -> Information)? Client versions?

FreeNAS-9.10-STABLE-201606270534 (dd17351)
Clients:Windows (any version)

 

[muzhik]

Post contents of /usr/local/etc/smb4.conf
Post output of "getfacl /mnt/path/to/share"

Proper authentication is a much better solution than IP filtering.

Yes, it works fine. i woudlike restrict by ip for /24 networks, it's not good making a lot of login-pass

 

[anodos]

Yes, it works fine. i woudlike restrict by ip for /24 networks, it's not good making a lot of login-pass

[The following assumes that this FreeNAS server is in production in an office / work environment.] If you have lots of users then it's a better idea to implement a directory server (or just take the time to set up the users). It's trivially easy to bypass "hosts allow" on a typical LAN. It just gives an illusion of security.

 

[muzhik]

[The following assumes that this FreeNAS server is in production in an office / work environment.] If you have lots of users then it's a better idea to implement a directory server (or just take the time to set up the users). It's trivially easy to bypass "hosts allow" on a typical LAN. It just gives an illusion of security.

I have two /24 subnets, it's easy and comfortable devide subnets, and allow only 1 subnet, i dont want make for all users in subnet. it not demand for purpose\work