Select an appropriate security level based on network deployment conditions

Article Title: select an appropriate security level based on network deployment conditions. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

In Windows, you can set the network security level. This security level is also introduced in the SAMBA server. Each security level corresponds to a set of default security policies. The SAMBA Server has four security levels: share, User, Server, and Domain. As a system administrator, you need to know the differences between the four security levels and select the appropriate security level based on your network deployment and security requirements.

　1. Introduction to various security levels and applicable environments.

1. Domian security level. This is the highest security level on SAMBA servers. If this security level is set, the SAMBA server itself does not verify the client's identity. Instead, assign the work to a dedicated domain controller or another server. In previous articles, I remember that the biggest advantage of using SAMBA server as the Windwos client and Linux server is that you can add the Linux operating system to Microsoft's domain. That is to say, the Linux operating system deployed with the SAMBA server supports the Microsoft domain environment. Therefore, if your current network environment is a domain environment, you can use this security level. The system administrator can add the SAMBA server to the Microsoft domain and enable the domain controller to authenticate the client. Microsoft's Domain Controller is responsible for the interaction between servers and clients, and handles user logon, verification, Directory Search, and other related jobs to provide high security. To this end, there is an early condition that domain management has been implemented in the enterprise network.

2. Servder and User security levels. These two security levels are very similar, so I will describe them here. The User security level is the default security level of the SAMBA server. It indicates that a User must log on with a valid account and password before accessing the server. In other words, the client must have a valid user name and password for access. In addition, the system administrator needs to clear the authentication time. In some systems, the authentication time occurs when the file is accessed. In other words, the client can access the list of shared files without a password. However, to access a specific file, you must provide a password. However, the User security level is different. Under this security level, identity authentication occurs during connection. That is to say, the client cannot provide a valid user name and password, even if the list information is not accessible.

The Server security level is before the User and Domian security levels. When accessing the SAMBA server, the client also needs to provide valid usernames and passwords. However, under this security level, another independent server will be responsible for identity authentication. This is very similar to the Domian security level. However, at this security level, there is no mandatory requirement for the domain environment. However, this security level is significantly different from the Domain security level. That is, under the Server security level, if verification fails on other servers, the Server will automatically downgrade the security level to User. Then, the User security level authentication mechanism is adopted. It can be seen that for the client, the User and Server security levels are no different. However, the system administrator can make a big fuss. For example, you can set different access policies and permissions based on different security levels.

Generally, if an enterprise has high security requirements and has an independent Server to complete identity authentication for mail and other application services, you can consider using the Server level. In addition, you can disable the SAMBA password file to restrict the server from using the User level.

3. Share security level. This level is the lowest security level in SAMBA servers. When the client connects to the SAMBA server, it can access the shared resources on the Linux server without providing authentication information such as the user name and password. Although this security level method is more convenient, it is obvious that its security is difficult to be guaranteed. It is difficult to reflect the client access information in the log information. However, the system administrator should note that if he or she uses the who command in Linux to query login user information, he or she will find some inexplicable users. This is mainly because in the share security level, the client does not need any account and password for access. In this case, SAMBA automatically provides a valid Unix account to identify the table client. Therefore, the system administrator will see some unfamiliar account information in the who list. Because of the lack of security protection at this level, we do not recommend that you use this level.

[1] [2] Next page