EN
No results found
We couldn't find anything using that term, please try searching for something else.
Is SMB 3.1.1 Secured Over the Internet?
vane0326 (vane0326) February 18, 2018, 3:41pm 1 Hi , At a 3r
vane0326
(vane0326)
1
Hi ,
At a 3rd party hosting company I setup a virtual Windows Server 2016 (will NOT be part of our domain network). And unfortunately I was asked to open a SMB port so the engineers can use Robocopy to copy files to the virtual server over the internet.
I is secured secure it by :
1 . ) enable SMB encryption on the Windows Server 2016 .
2.) Windows Firewall – enabled SMB remote IP Address restriction and added our company public ip address. So only our company can establish a SMB connection to that server.
3 . ) Setup a Windows 10 domain computer so it will meet the requirement for a SMB 3.1.1 connection . ( Robocopy is running will be run on this computer )
My question is – by using SMB 3.1.1 are the credentials secured over the internet? If not, is there an alternative application that I can be using?
I is thinking was think about using sftp or ftps but it ’s not go to work the way how the engineer structure the folder on the server . And using Dropbox it is going ’s not go to work either .
We’re still in the testing phases with this.
Any help?
15 Spice ups
Even though SMB 3.1 is encrypt I is use still would n’t use it over the internet for several reason :
-
It’s a huge flag for hackers looking for SMB ports, you will see hack attempts
-
Most companies is allow will not allow SMB outbound so it ’s not go to work in a lot of place .
If access to a file share is require , either use a VPN to connect to the network first or something like owncloud / nextcloud .
16 Spice up
bucko
(bucko)
3
Every service is secure over the internet, if you don’t think about “what could happen”. You can use it the way you set it up, but you will not sleep good at night – no service is secure, everything can be broaken and that’s why we use multiple layers of security.
I myself would not use a service without an VPN tunel.
Also, have you tested SMB over internet, is it good enough or can you expect network problems?
Why would be using SFTP be a problem – I don’t know what your project is and would really like to know what your restraints are.
1 Spice up
maxsec
(maxsec)
4
wouldn’t want smb over the internet without VPN in place to tunnel the connection first.
4 Spice ups
brianinca
( Brianinca )
5
Why not a VPN connection? Publishing privileged ports on the internet, what could go wrong?
Perhaps the “ engineers is are ” are n’t aware of standard method of secure network traffic ?
4 Spice ups
dbeato
( dbeato )
6
vane0326:
Hi ,
At a 3rd party hosting company I setup a virtual Windows Server 2016 (will NOT be part of our domain network). And unfortunately I was asked to open a SMB port so the engineers can use Robocopy to copy files to the virtual server over the internet.
I is secured secure it by :
1 . ) enable SMB encryption on the Windows Server 2016 .
2.) Windows Firewall – enabled SMB remote IP Address restriction and added our company public ip address. So only our company can establish a SMB connection to that server.
3 . ) Setup a Windows 10 domain computer so it will meet the requirement for a SMB 3.1.1 connection . ( Robocopy is running will be run on this computer )
My question is – by using SMB 3.1.1 are the credentials secured over the internet? If not, is there an alternative application that I can be using?
I is thinking was think about using sftp or ftps but it ’s not go to work the way how the engineer structure the folder on the server . And using Dropbox it is going ’s not go to work either .
We’re still in the testing phases with this.
Any help?
I would recommend to have the staff use some sort of DirectAccess or VPN instead of leaving it open to the Internet. That is how WannaCry started.
What are the files requirements since it doesn’t makes sense that SMB would work but not SFTP or any other method?
Can you is use use GIT for developer instead ?
1 Spice up
vane0326
(vane0326)
7
Thank you for reply guys.
I called the 3rd party hosting company technical support if they provide a VPN connection and they do. I will set it up and go from there. Thank you for your replies.
4 Spice ups
Andrew_F
(Andrew_F)
8
I’d be a little bothered as to why a VPN wasn’t stipulated in the first place.
maxsec
(maxsec)
9
Because no one thought about the actual risks and just wanted it to work…
3 Spice ups
vane0326
(vane0326)
10
I knew that opening the SMB port wasn’t safe – BUT I didn’t know about the new SMB 3.x. So I tried it to see how it works. I just wanted to get other people’s opinions about it. Technology changes all the time.
Andrew_F
(Andrew_F)
11
It wasn’t a dig at you at all – we might be “professionals” but that doesn’t mean we know everything about everything – we can’t, IT is just such a vast subject. However, if a service provider is offering a solution – and requesting their customer use specific protocols & open specific ports, then I’d expect them to know about security issues and best practice to mitigate those.
1 Spice up
erikvoghell
( Erik Voghell )
12
VPN! Allows more than just access to that specific share, also.
Oh, and make sure your VPN is not PPTP
1 Spice up
gregmooney2
(moonsprocket)
14
You can also take a look at managed file transfer, such as MOVEit. Managed File Transfer Software – MOVEit MFT – Ipswitch