Dream combination: Usermanagement + Filer + Internet/ Cloud connectivity

[gea]

We mostly talk about technical details of a certain server or setting.

Today we (small university) have had a final discussion about how to combine role based user management, secure filer services (SMB) and external internet access via secure ftp or preferable https with "a real simple" setup and management and relatively low costs.

Background is the demand (EU) for datasecurity with protection against ransomware, readonly versioning, encryption of filer and backup and role based access control. Additionally there are demands for data privacy according to DSGVO, the european General Data Protection Regulation (GDPR) as we need to process personal data. This excludes per se (cloud) services outside EU. Even educational cloud offerings like BW Sync and Share (Nextcloud, BW/Germany) excludes personal data processing in their terms, propably due the required control contracts and because Cloudservices like Nextcloud offers an access by email-Link, a NoGo for personal data.

The rolebased usermanagement part is easy: Windows Active Directory. The storage part as well. ZFS offers all what is needed and now even the encryption part. ZFS on Solarish additionally offers the "it just works", perfect Windows AD integration with Windows ntfs alike permissions and sid (permissions remain intact after a pool move/restore), Windows groups (allows groups in groups) and Snaps as pervious versions, all working without without hassles out of the box.

The biggest problem was Internet access. The usual Cloud options were a horror to setup with AD and external filer access or simply not acceptable due access options without authorisation and authentication (Access by mail-link is a NoGo).

We now finally decided to use the Titan sft server. This is a Windows application with perfect Windows AD integration for secure ftp and https. You login with an AD account and can access folders on a ZFS filer fully transparent regaring Windows AD permissions. The offered folders are group or user dependent. Folders are only shown when you have access, simply a perfect combo.

Costs:
Windows AD server (depends on number of users)
Solaris/ OmniOS ZFS filer (depends on capacity and optional support contract)
Titan SFTP with https around 2000 Euro + 500 Euro support/year (+ a Windows license)

The best:
Ultra-Low complexity on setup + management, really a dream combo.
(When you can setup AD, Titan and ZFS filer is much easier to setup than AD)

http://napp-it.org/doc/downloads/dreamteam.pdf

 

[DedoBOT]

Did you try NextCloud with file transfer plugin . I was fighting with it a year ago but did not liked the outcome and end with good old solutions of uncoupled VNC and sFTP . Crude but just 4 remote reliable users .

 

[gea]

I tried Nextcloud. The positives are the clients for different operation systems and the sync and share options with collaboration features. As a method to access centralized SMB storages based on AD users, roles and permissions, either by lan locally or internet, I found it less suitable. I had troubles using AD as authentication source and was not able to access SMB storage with same user credidentials (Windows AD SID) what makes a seamless access impossible for both local and internet access with identical permission restrictions.

For a simple, fast and secure internet sharing option I found S3 with minIO more suitable as this is a really simple solution (minIO is a single file solution, just install and run) where you can share a ZFS filesystem via internet based on a simple user/pass combo via web browser or other backup or sync tools, see https://forums.servethehome.com/index.php?threads/amazon-s3-compatible-client-server-minio.27524/

 

[DedoBOT]

Thanks, you gave me idea to play with it the upcoming week.

 

[Rand__]

The sole reason for Titan is the need for browser based file access, right?

 

[gea]

The browser based access for up/download is an add-on to the ftps/sftp server.

Titan shares SMB folders on local AD storage servers via web, sftp and ftps to the internet with optional 2FA. You can select the visible folders from all AD storage servers on a per all, per AD group or per AD user base. Only subfolders within the shared folders where you have at least read permissions are visible. This allows to share a whole users folder where only the own folder is accessable. All other subfolders from other users are unvisible.

Basically, Titan behaves like a virtual AD Windows SMB client between a remote internet user and local storage.

 

[Bronko]

About Titan to much MS based solution for me. For internet file access I still prefer good old OpenVPN solution and will check out minIO asap...

 

[gea]

We use VPN that is quite simple to use as you only need to install a preconfigured client app. Despite is has a complexity and problems on any new OS release especially OSX. Many of our users do not like it for this reason and want a "simple" web access from a browser. And at last, a VPN tunnel is quite slow even with our expensive Watchguard appliances.

If you use Active Directory for a role based user management (what is the de facto standard) I have not found yet any other solution (Windows or X) what allows a to Solarish/Windows SMB identical access from the internet over several ZFS (or Windows) filers via ftps, sftp or https. Any other solution that I have found has far less features with a much higher complexity to setup and maintain and does not integrate with the new data protection rules in the EU for personal data.

S3 web access with minIO is an ideal extension as it is far superiour regarding performance and simplicity. You have no AD authentication with S3, only a user/pass like with Wlan and WPA2, so its more suited for single persons or project groups with an easy sharing option for files for anonymous access by a link that expires automatically ex within 7 days.

 

[Bronko]

Yes, I know @gea and full acknowledge. But sometime its hard to leave Microsoft/Apple paths and there is no compliance on user site about simplicity lost, for sure.
It is time to drop monopolistic businesses cases around licenses and certificates, on schools, universities, public administrations ...
Doesn't find any reliable technical support on big player site (beside good old SUN ;-), only salesmen with a greed for signatures, all the time as an employee on a big global company. Technical issues must be solved by our own. Why don't use open source right from the start and paying for real support?

Several years ago my OmniOS file servers wasn't able to join OpenLDAP directory service build by my own, so I switched to MS AD again, knowing that it is a well-functioning system all the years in big old company, regarding a ZFS Solarish File Server especially. But I doesn't like it since we have Linux desktops only beside some rare OSX devices.