Hey everyone and welcome back. Now in the previous nugget we had walked through the basic configurations
of our SAMBA server. What I now want to do is to turn your attention to and look at a
little bit more closely the process of working with passwords and authentication with respect
to our SAMBA server. So with that said how about we dive in and let's get to it then
shall we? Now the very first thing which I want to briefly talk about is the concept
of hashing. Now if you don't know what hashing is all about a hash is a one-way function
and it allows you to effectively encrypt your password. Now the key thing here is one-way.
So when we talk about hashing a password we could have a password like say John and we
run it through some type of one-way function and then it becomes all of this garbled indecipherable
text but the key point here is that with respect to the one-way function is that when we run
the password through that function we actually can reverse engineer that password i.e. you
couldn't take this here i.e. the end product and run it through the function in reverse
and be able to get the original passwords. Now this is done for purposes of security because
servers who are storing all of people's passwords say for example if you go on to your Google
account Google has to have a database of all of your password credentials so that you can
log in but Google doesn't want to have a clear text database of all these passwords like
John 1 and John 23 whatever it may be because in the event that Google's servers happen
to be hacked then the hacker could see the clear text password as well as the username
to which that corresponds to and then begin logging into that account or perhaps even
trying that username password combination together on other sites maybe say banking websites.
So we don't want to have this we want to have our passwords stored in an encrypted forum
but it's crucial that the encrypted passwords cannot actually be reversed so we've got all
this encrypted password stored. If the same server was compromised and the attacker was
able to see the end product of the encryption they should not be able to look at what encryption
algorithm was used to reverse engineer and ultimately get the original password back
which may be say for example John 1. So really this is very secure but it does actually
present a little bit of problems when we have different hashing algorithms in play. Now
with respect to our SAMBA passwords this is pretty much done the way Windows handles
passwords so they are encrypted one particular way whereas on your regular Linux system the
passwords are hashed any different way. So what exactly is the relevance here? Well as we know
hashes are one-way functions they cannot be reversed so you can't just take the hash of a
Linux password reverse engineer it to get the original plain text password and then run it
through another hash to get a SAMBA compatible hashed password that process is simply not
possible. So when we want to have our password be authenticated by our SAMBA server we want to
make sure that our password is hashed in the correct way. Now in order for us to generate a
SAMBA password we can use a particular command called SMB PassWD. So this command here is
certainly a command that we want to be digging into so with that said how about we begin building
some shares over the network that actually cannot be accessed by anyone we actually are going to
require some type of specificity as to who can actually access the shares that we are well
sharing out. So with that said what we'll do is we will go back in to our SAMBA configuration file
because like I say right now if I go back notice when I go to my network here and I go into system
and I double click the share of public blah there is no credentials at all required here to
access this okay so let's try to lock a share down and see what happens then so what we'll do here
so I will say sudo nano etsy SAMBA smb.conf and I will go in to the file so let's scroll all the
way down to the very bottom here and create a new share once again so what I will do is call this
another random share and I will say the comment will be testing some authentication stuff and the
path this time I will actually make it a different name just so we can see that we don't actually
have to have the name here match up so I'll just call this maybe say test one and now what I want
to do is I want to specify the users who are able to access this particular share so what I will
say is valid users and I'll make this equal to Trevor okay I will then say read only ie should
this be writable I will say no so it's not read only it can be written to and I will create a mask
so I will say 0777 very permissible masks I will also have the directory mask at the exact same
all the sevens and now what I will do is I will save this and I'm going to have to create this
directory here called test one so I will exit back out I will go to my root directory I will say
pseudo MK Dar test one I will just make the permissions super relaxed once again so I will
say all the sevens on test one so if I do an LS-L we can see here once again very relaxed
permissions anyone who has access should be able to do anything so now if I go into my Etsy password
file right now if I scroll on down we're not going to see any user here called Trevor I'm going to
add Trevor we can see IPv0 after all let's go back and I will say pseudo user add m Trevor and then
I will say pseudo password Trevor and I will type in the Unix password I'll just say Trevor one and
I will confirm that as Trevor one so if I go back into the password file if I scroll on down at the
very bottom we can now see we have a user called Trevor okay so if I go back out so let me clear
the screen now what I'm going to say is pseudo SMB pass WD and then dash A and I'm going to add
Trevor and I will just say the password can be hello and then hello again so now the user Trevor
has an SMB password now what I'm going to do is I'm going to restart the server so I'll say system
CTL restart SMB D and I'll restart NMBD so I'll go to the network I will right click and refresh
let me go in here we can see another random share with the description testing some authentication
stuff if I click this it's going to prompt me to enter credentials now so I will say Trevor and
then I will say Trevor one notice that this is not going to allow access however if I take the
password hello this indeed now gets me access because I'm using the SMB based password not
Trevor's Linux based password you see that so now what I want to do is I want to say new and I will
create a folder I'll just say some new folders here and I'll double click and then I will say new
text document and I'll just say my file if I open this up and I just say this was modified by
Trevor so if I save this one thing to note here is that on my Windows system I actually don't have
any users on this system called Trevor the actual authentication here was by virtue of that user
existing on the Linux system and the fact that that user had an SMB password configured on that
Linux system because of this even though via my Windows system there is no Trevor user present I
could still log into that system access the share and make the necessary modifications as I see right
here so if I go back to my Linux machine minimize this and if I do a CD into the root directory I go
into the test one folder do an LS we can see the some new folders here we do an LS we can see my
file and I can cat my file and we can see here indeed this was modified by Trevor now one thing I
will say is that it might be strange or confusing to have users on a Windows system that don't actually
exist on the Linux system and vice versa been able to tie everything together can be a little bit
awkward for example in my case to access this particular share from the Windows system I had
to enter in a username which doesn't exist on my local Windows system and I suppose I could just
have these credentials pass to me by someone on the network just saying hey use the username Trevor
but this can be clunky it can be difficult to manage moving forward so what I can actually do
is I can actually map accounts for users that don't actually exist on my Linux system that means I
can tie the Windows user names to valid accounts on the SAMBA system so let me show you how I could
actually feasibly do this if I go into the exe directory and then go into SAMBA once again we're
going to go into that smb.com configuration fail that's going to help us out so much if I scroll
on down what I'm going to do is under the global settings which we can see right here I'm going to
add the keyword username space map and what I'm going to do is I'm going to point to a particular
configuration fail now this configuration fail doesn't actually exist so I'll just specify the
path right now and then I will create it and I'll just call this maybe my mapper okay because I'm
going to map Windows names to my local names okay okay so like I say this fail doesn't actually
exist right here so what I want to do is I want to create it so I'll save this for now and I will go
in and within this directory I will say sudo nano and I'll create this file called my mapper now all
I'm going to do here is a type of key value formatting i.e on the left will be what I want to
specify so let's maybe just call this linux underscore user and I will make that equal to
the value trevor so that means that the user on Windows could just specify linux underscore user
and under the hood the SAMBA server is going to interpret that as the user trevor and as we know
the user trevor has been granted access to that latest share so when the Windows user enters in
the generic linux user credential it will map to this and they still will get access now this can
also be very useful let's maybe say we create another user let's maybe say gai magovern and that
is on my windows account I can map that to ipv0 which is what is on the linux system when I'm on
my windows system if I just type in gai magovern it's going to map to ipv0 and if ipv0 exists within
the SAMBA configurations and the permissions of who is allowed to access a particular share
then gai magovern still will get access and what we can also do by the way is we can actually just
add in email addresses so I could say gai magovern at CBTN blah blah dot com I can make that map to
ipv0 or make it map to john whatever it may be meaning that on my windows machine I could actually
use this email address and have it correlate to this username on the local linux system but for
now what I'll do is I'll exit out so that is how we can neatly map different username together
but what I now want to show you is how we can actually query the smb server for particular
information using the smb client command so let's say we were on a machine and this doesn't
have to be on the local server like I am right now this could be a separate linux machine say for
example I could just say so though smb clients and I could say dash u for trevor and I can say dash l
to list the information relating to the shares that are available to trevor on the server and this
is the server ip address 192 1680.44 if I hit enter it's going to ask me for trevor's password so I
will just say hello and hit enter and we can actually see here the shares which are available
right now so we can see here say for example public blah which was available to absolutely everyone
and we can see the another random share which was the share we actually created to test some
authentication stuff now if I want to be a little bit more specific oh and I accidentally copy pasted
right there if we want to be more specific what I can actually do here is the sudo smb client and
you trevor and then I will say forward slash forward slash followed by the ip address of the
server or the name of the server if you wish and then forward slash and then the name of that
particular share so I could say maybe public blah there we go if I hit enter I'm going to have to
type in the password which is hello for trevor hit enter and we can see here we have access to a
command line if I say help to get a list of the commands if I do an ls we can actually see the
file which is within this particular folder the test 123 and if I happen to exit out and I do the
same for another random share type in the password hello again we do an ls we can see some new
folders here again accessible to trevor I could cd into that folder just like we see here do an ls
and let's just maybe say I wanted to remove the file I could delete that file right there and ls
and now that file is gone so a different way that we can use to actually access the server as a
linux client over the terminal now one last thing that I just want to briefly show you if I exit
out and I go back into my configuration so I'll go into it say samba smb.conf notice that with respect
to the visibility of our server if I go to network we can see the server is called system as per the
host name I could present a different name by using the samba configuration file once again
so lastly before we close what we will do is within the global section what I'm going to do is I'm
going to add this configuration right here I'm going to say net bios name and then I can give
the name of my server which I want to present to the shares so I could just maybe call this let's
call it share server whatever it may be let's save you and then I'll do my system CTL restart
smb d as well as nmbd and now if I go back let me close this down I'll open a fresh one let's go
to network and if I right click and refresh the server is now seen as share server which we can
click into and again we see the same information that we saw before no problem at all okay so that
is us for our samba authentication I hope this has been informative for you and I'd like to thank you
for viewing