I have Linux server hosting separate samba share for users on some windows clients (each user would have a linux client also accessing their share) (users have authenticator app on separate devices). I want these shares to be automounted with saved password, but I want to setup TOTP on the server so that:

  1. Periodically the server would disconnect connection/block access to the samba share.
  2. (likely custom) software/web app accessed on the Windows client cause a prompt to appear for user to enter TOPT code to send to sever to validate.
  3. Entering the code would to regain connection/access to the shares.

It is important the client doesn't do the actual disconnecting/blocking and it is done via the server.

I know there could be a script on the server to modify the samba configuration to remove/comment out the share for user and restart the server (and time it so as not to cause conflict with other time out), but I imagine the samba server restart is can be disruptive for other users (even though short) and has chance to cause file corruption for files actively modified or transferred. Is there a samba option for this that can take effect after reloading the configuration rather than restart?

I don't have control of the IPs the clients connect with so I cant implement some temporary firewall rule to block access.

Can this done with ACLs? These shares have thousands of files. Can the root directory of the share be changed to a different owner and have the the files within inherit the permission without time being spent waiting for all the files permission to be updated (I want to prevent specifying a path past the root directory of share to access it because permissions weren't changed for it.)?

I suppose if 'No' for all of the above I could own the samba share as a different user, store the files of the samba share in another location, do a bind mount (this instead of symbolic link to reduce issues with selinux) from the other location to the samba share, and then unmount at will and since the actual samba share is owned by a different user with restrictive permissions will cause applications wanting to write or read to it access errors, but I'm not sure how this or any of the other possibilities would affect active file transfer, applications in the middle of a write, or other.


You must log in to answer this question.

Browse other questions tagged .