5

In /etc/samba/smb.conf I have

Writable=yes
Browsable=yes

This allows pretty much open access to that folder. In a home network, where the pi is connected to a home router. Is this any danger.

I've no port forwarding. Router UPnP is off. Router guest networks are disabled. The pi doesn't leave my home. Assuming strong WPA wifi passwords, should I take additional precautions in regards to the Samba shares on the pi?

Improve this question

2 Answers 2

Reset to default
5

Well, this is quite a hard question to answer in a way that will be acceptable to security buffs, but I'll go ahead and try anyway:

As long as you don't have any port forwards and your router remains secure, I'd say you are pretty safe, however it seems that anyone connected to your net will be able to access and change the content of your share. Note that this is not limited to WiFi - anyone that can get physical access to a connection on your routers wired interfaces will also have access.

Also, you seem to have no access control on the samba service itself. Have a look at this documentation on how to set up user and access control levels on your samba.

Improve this answer
4
  • 1
    This is my home; so as far as physical access, My level of trust would have to match with people that I invite into my home. So yes, once someone can touch my router or pi, game over. The spirit of my question was asking about reasonable. However, considering that this is also a learning exercise. I should continue on and apply samba users and passwords as well. Thanks for suggestion. Upvote.
    – Rick
    Jan 24, 2016 at 15:06
  • 1
    Thanks - well, reasonable depends on what you plan to keep on it. Homework and hobby landscape photography - one kind of security. Your research about who's who in the major plot between the gov and the mob - quite another. ;)
    – Bex
    Jan 24, 2016 at 15:10
  • 3
    Samba on its own, even the Microsft native version is NOT enterpise ready. (Meaning its sucks at security!) - The only way it works properly is with Domain policies, requiring proper configuration. Samba on Linux is a reverse engineered app, and it may be better at Linuxy stuff but still sucks at security. If you Pi is DMZ (demilitarized zone, aka connected drieclty to the internet with no firewall) it will get hacked very quickly. That is why routers use NAT and port forwarding, to protect you from these bad things.
    – Piotr Kula
    Jan 24, 2016 at 15:42
  • Nothing in my home network is DMZed. Everything is behind the router which I keep up-to-date. Contents are baby photos, home media, and laptop backups. However, I back up the encrypted volume of my home folder. Tax documents and others I run through gpg anyways.
    – Rick
    Jan 24, 2016 at 18:35
6

You are still vulnerable to:

  • Cryptolocker-style viruses running on any other computers in your network (including on any guest machines you might let on to your home network)
  • Malicious or careless users on your own network
  • Access by someone who gains access to your wireless network (WPS attack or weak/leaked wireless key)
  • Vulnerabilities in the router exposing your information to the wider internet

That list is non-exhaustive, but covers some likely scenarios. Your data may also be vulnerable to hardware failure, power outages, etc but I've assumed you specifically mean security-related vulnerabilities.

In the end, it's up to you to trade off the value of the data against how much effort you spend defending it. There's little cost to setting up user accounts and passwords, and it gives you another layer of security against some of these vulnerabilities, so seems a reasonable precaution.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.