Over the last few months, my primary focus has been hacking. As an attacker, seeing file-sharing systems like Samba, FTP, and NFS get me excited to find loot! However, in my downtime, I love to partake in movie watching from my ever-growing DVD collection.
The problem is that I love using my Chromecast.
The solution was to combine a few different pieces of technology I had lying around to build a quick, affordable, and secure media server for my home network. For me, it allowed me to step through how to implement basic security controls onto a Samba share (as opposed to those you find in hacking labs) to protect from unauthorized access.
This process makes use of a Linux system to serve a Samba file share over your home internal network. Once the Samba share has been set up, VLC for Android can be used for accessing Samba and Chromecasting to your favorite device.
Heads up! This guide assumes you have a spare computer with Linux installed for Samba. If you prefer Windows or something else, go for it! This also assumes you have a compatable Chromecast already set up on your home network.
Another heads up — this article won’t cover how to obtain your media. Just serve it up. Keep it legal, folks.
Here’s what I used for the setup:
- A Raspberry Pi Model 3
- My favorite Android device
- A home network
With our pieces, it’s time to:
- Install Samba
- Set up firewall rules
- Configure a Samba password
- Configure the Samba service
- Serve up some media and cast!
To get started, we need to install Samba on our Raspberry Pi. First, let’s make sure our Pi is up to date.
sudo apt-get update
sudo apt-get upgrade -y
With the latest updates, Samba can be installed as easy as running:
sudo apt install samba
To make sure the smbd service is enabled and running, let’s run:
sudo systemctl status smbd
If we get Active in our output, we’re good to go!
Set up Firewall Rules
Since this service will only be exposed internally on my own network, this step might not be totally necessary. However, if you plan on ever exposing this service over the public internet, you’ll want to consider adding some allow rules to only allow IP address you trust accessing your Samba share. There are many ways to create IP rules, but we’re going to use
Let’s start with installing
uwf if it isn’t running on our Pi:
sudo apt install ufw
Now we can add allow rules for the Samba ports (139, 445) for our ruleset:
sudo ufw allow from 192.168.1.0/24 to any port 139
sudo ufw allow from 192.168.1.0/24 to any port 445
uwfwill start denying any connections except for those you specify! If you need to reach your server via ssh, be sure to add additional allow rules. For example, `sudo ufw allow from 192.168.1.0/24 to any port 22` to allow SSH access from inside your network.
With rules in place, time to enable our firewall:
sudo ufw enable
Note you’ll be asked to confirm, but here you can hit
y. If you modified connections for SSH, the risk here is that your connection could be dropped
To confirm your rules, run
sudo ufw status
Configure a Samba password
This is an easy step, but pretty important.
sudo smbpasswd -a pi
This command adds the user
pi for Samba access while prompting you to input your password. There’s definitely a lot more you can do with users and configuration, but let’s keep it simple for now.
Configure the Samba Service
We’re almost there — I promise!
First, let’s make a share we want to expose:
sudo chown nobody:nogroup /home/pi/samba
Let’s set up a super simple configuration for our Samba share. Using your favorite text editor,
vim, we need to edit the
sudo nano /etc/samba/smb.conf
At the very bottom of the file, add a configuration like the following:
path = /home/pi/samba # or path to your folder you want to share
browsable = yes # allows other network devices to find the share
read only = yes
Feel free to replace `samba_folder_name` with your preferred name — this is how your Samba share will appear on the network.
Now, restart the
smbd service to apply your changes.
sudo systemctl restart smbd
Set up some media and cast
First, grab your favorite mobile device and install VLC for Android (or its respective iOS counterpart).
Assuming the steps have been done correctly, you should see your server listed.
After tapping on the server and choosing your named share, enter in the username (in this case,
pi) and the password you set from earlier.
Finally, select your video file and look for that familiar Chromecast icon.
Your media should magically appear on the chosen device!
Can we do more with securing Samba? Sure
Can we do some neat port forwarding to make our Samba share accessible over the internet? You betcha
… but I don’t want to for now.
Either way, I hope this has been helpful. The steps in this article have been derived from the sources below so go ahead and check them out for more information on Samba and UFW.