5

I'm working on a project to setup a secure system to share files between 5 Windows computers. The computers are part of a domain so could have multiple different users logging in (based on an AD group). The files would contain bank/account information. It is possible to setup a server using re-purposed hardware.

I've looked at NFS or Samba, but it doesn't look like I would be able to encrypt the data in transit without additional setup (like VPN). Other options I've found so far are Syncthing or Unison. The advantage of sync would be each computer has a copy in case something breaks.

Any suggestions on how I could get this working?

  • One suggestion: if you do setup a new server, do NOT bring it within the existing Windows domain for authorization purposes. Too many things can happen to compromise Windows domain single-sign on credentials to provide the security promises you would want for a server holding banking information (Though really I could say that about most common single-sign on solutions.) My first reaction about what you should do is implementing a hardened file server with HIDS and, as you say, secured links to clients. But as you point out, that has the downside of non-sync for offline access... – mostlyinformed Oct 19 '15 at 18:02
  • ...Which, I guess, leads me to the question of what kind of usage scenarios we're talking about here. Are any of these 5 pcs laptops, or otherwise expected to be mobile? Is synchronization & offline access of the information using these PCs just desirable, or is a practical necessity? – mostlyinformed Oct 19 '15 at 18:09
  • Sync is just desirable, definitely not necessary. These are Windows 7 PCs (desktops) – nijave Oct 20 '15 at 4:06
  • Hmmm. My first instinct would be toward the conventional high-security approach thing: hardened file server on hardened server OS with host-based IDS and full-disk encryption server side, with IPsec protecting the desktop-to-server connections. But that's a big PITA, both to setup and maintain, of course. It also only protects the sensitive info when it's at rest and on the server. On the other hand, using file-level encryption where encryption & decryption of the files would occur on the clients would simplify server & connection security a whole lot, but bring its own big issues. Hmm... – mostlyinformed Oct 21 '15 at 21:17
2

SMB 3.0 (Windows 8 / Windows Server 2012, or newer) supports encryption. To enable it, use the PowerShell commands on this page (verified on Win10 Enterprise, non-domain-joined). By default, once enabled on the server, unencrypted or legacy connections will be rejected. This also automatically enables integrity (signing) checks.

I don't know of any way to enable Win7 (or older) machines to connect to an encrypted SMB share (it's not possible to install SMB 3.x on legacy Windows versions). The next best option may be IPsec, which is supported in most Windows versions but is not trivial to set up (much harder than running a single PowerShell command, at least).

  • Unfortunately these are Windows 7. I was considering possibly using OpenVPN – nijave Oct 20 '15 at 4:07
  • Ah, probably should have mentioned that in the question. Strange though it may seem, at this point Windows 7 is three OS releases behind the leading edge and its capabilities are not necessarily the default ones that people expect a Windows OS to have now (as with encrypted SMB). Exercising your free upgrade to Win10 might be an option. Another might be to set up SSH access between the machines, and use SFTP. – CBHacking Oct 20 '15 at 5:18
  • VPN could work, but seems both like overkill if you're just using it for file sharing, and dangerously easy to do wrong. Because you aren't encrypting at the application level, you need to make sure that your file transfer application sends its traffic over the VPN. You probably don't want to send all network traffic over the VPN, though, as that will make the VPN server a bottleneck that it doesn't need to be. – CBHacking Oct 20 '15 at 5:19
  • How can anything be harder than a single powershell command? Any amount of commands can be summarized into a script that has to be written once for the entire world's benefit :) – masterxilo Feb 8 '18 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.