Safest way to view files over network

[gibbs1984]

Hi all,

I have Linux Mint 21.2 Cinnamon (64 bit) on my laptop.
I also have a mini PC acting as my mini server with Ubuntu 22.04.3 LTS Gnome (64 bit).

I do have SSH setup to access the server for installing things etc.

The server with Ubuntu on runs Plex Media Server (the server and the data) and also Nextcloud, both of these are accessible from outside my network so I can upload files to Nextcloud and watch movies on Plex when I'm not home.

I want to be able to access the server files from Nemo from my laptop but obviously do it securely. I used to have a Samba share when I had my server on a Raspberry Pi and I've looked at NFS but I've read that both of these are vulnerable when exposed to the internet, not sure if I'm misunderstanding this?

So, what is the best way (apart from SSH because I want a GUI) to have the file structure setup in Nemo to access the files on the server?

I also have VNC installed but as my server doesn't have a monitor it doesn't connect.

[altair4]

I'm a little confused by one aspect of your use case:

Is the Mint client accessing the Ubuntu Server within your home network? Or are you accessing it from the internet?

[gibbs1984]

I'm a little confused by one aspect of your use case:

Is the Mint client accessing the Ubuntu Server within your home network? Or are you accessing it from the internet?

My Mint laptop is only accessing the Ubuntu server from within my network, my laptop never leaves my house.

Maybe that's where I'm getting confused with the vulnerabilities over the internet?

So even though my server is accessible through Plex and Nextcloud via my mobile phone or a browser on another computer (not my laptop and only through those app clients) from outside my network, using NFS or a Samba share should be safe?

[altair4]

Without exaggeration I haven't used NFS this century so I can't speak to that.

Samba allows for something called encrypted transport which allows for a ssh-esk like transfer of data between server and client.

An example:

I will create a share on my Xubuntu server:

Code: Select all

[Test]
path = /Test
read only = no
guest ok = no
server smb encrypt = required

I will then access that share from Mint ( ip = 192.168.1.177 ) using a temporary cifs mount:

sudo mount -t cifs //vxub2204.local/Test /home/tester/MintTest -o username=smbuser,password=smbuserpw,uid=tester

If I go back to the Xubuntu server I can verify the encryption with a sudo smb status:

Code: Select all

Service      pid     Machine       Connected at                     Encryption   Signing     
---------------------------------------------------------------------------------------------
IPC$         14348   192.168.1.177 Sun Jan  7 10:06:25 AM 2024 EST  -            -           
Test         14348   192.168.1.177 Sun Jan  7 10:06:21 AM 2024 EST  AES-128-GCM  AES-128-CMAC

server smb encrypt = required makes this encrypted transport process mandatory.

You can't do this on guest accessible share. A unique key is generated between the server and the client for that samba user and no others.

[Coggy]

What's wrong with Nemo? Doesn't that count as a GUI?
Just put in the address bar: sftp://username@hostname
Best to configure passwordless ssh (uses keys) and disable password, to prevent password guessers.

[altair4]

If you want access to the entire file structure of your server then yes ssh if preferable to samba.

You can get fancy with this if you want.

On the ubuntu server:

[1] Install avahi - it's not installed by default:

Code: Select all

sudo apt install avahi-daemon

[2] Then create a file at /etc/avahi/services/ssh.service with this content:

Code: Select all

<?xml version="1.0" standalone='no'?>
<!DOCTYPE service-group SYSTEM "avahi-service.dtd">
<service-group>
   <name replace-wildcards="yes">%h SSH</name>
   <service>
       <type>_sftp-ssh._tcp</type>
       <port>22</port>
   </service>
</service-group>

That's pretty much it. From Nemo under Network > Network you will see the ubuntu server as hostname SSH

Or you can do what Coggy just said and bookmark it.

[gibbs1984]

OK thanks everyone, I'll have a look and play with these options.

I have no real preference apart from security really, just want to make sure I'm not opening myself up to hackers.