Author Archives: Suncatcher

SMB/CIFS security in heterogeneous environment

Posted on by

Suppose I have several machines both Linux and Windows I want to connect to each other for file-sharing. Now I use mount -cifs command with vers=3.0 clause to access Windows shares from my Linux machines

mount -t cifs -o credentials=/etc/credentials.cred,vers=3.0,uid=1000,gid=1000 //192.168.137.1/folder /media/folder

and I also use standard Windows SMB/CIFS functionality to access Linux shares from Windows 10. What bothers me is the efficiency of such configuration.

I know that I can utilize encryption and signing in Windows, e.g. via Set-SmbServerConfiguration –RejectUnencryptedAccess $false, and I also know I can do this in Linux via smb.conf.

The question is: what is the most secure way to organize dual-way Samba sharing between Linux and Windows? Should I set up Linux as a server and Windows as client or vice versa?

It bothers me because of recent ransomware epidemic and impossibility to prohibit SMBv1 in Windows in such mixed heterogeneous landscape. When I turn off SMB/CIFS like this, my Linux boxes cannot access Windows boxes anymore.

Continue reading SMB/CIFS security in heterogeneous environment→

Port forwarding and port blocking security concerns

Posted on by

I am highly concerned about RDP security and about multiple occasions of ransomware infections through RDP, so now I am inspecting possibilities for self-defense against these threats.
What interests me a lot is securing of router ports from outside. As it was thoroughly explained here, blocked/filtered port is better than just port having no services bind to it, ’cause blocked port doesn’t send response to attacker.

However, what if the port is not blocked , but not forwarded anywhere on router level? Is it equivalent to blocking in sense of security?

In my understanding, unforwarded port is just simply redirected to nowhere, and attacker just cannot use it to compromise anything. Does this makes any sense?

UPDATE: Added reference links for @ISMSDEV and others who don’t believe that ransomware and RDP are following in toe.
1. Ransomware and RDP – Are you vulnerable?
2. Ransomware spreads through weak remote desktop credentials
3. Ransomware using Remote Desktop to spread itself

Continue reading Port forwarding and port blocking security concerns→