Ransomware operators love open SMB shares. The 2017 NotPetya outbreak propagated via EternalBlue, but also through admin shares with weak credentials. Even with patched systems, a misconfigured share can give attackers a foothold. This lesson focuses on securely sharing folders across Windows, Linux (Samba/NFS), and macOS, including protocol-level hardening and enumeration protection.
When sharing a folder on Windows, the default permission often includes 'Everyone' with Read. While NTFS still restricts access, an SMB share level with Everyone: Full Control lets anyone connect and attempt to access files if NTFS is misconfigured. Set share permissions to a specific security group (e.g., 'Finance-RW') with Change access. Disable SMBv1 entirely via Windows Features or PowerShell (Set-SmbServerConfiguration -EnableSMB1Protocol $false). Use SMB encryption for sensitive shares.
The output shows the share Finance with appropriate access rights for two groups. No Everyone entry is present.
When deploying Samba, the smb.conf file must lock down authentication, protocol version, and share definitions. Set server min protocol = SMB2_02 (or higher) to disable SMB1. Restrict share access with valid users = @groupname and force group = +groupname. Use hosts allow/deny to limit IP ranges. For high-security, enable SMB encryption (smb encrypt = required) and disable guest access (map to guest = never).
# smb.conf snippet for hardened share
[SecureShare]
path = /srv/samba/secure
valid users = @finance
force group = finance
read only = no
browsable = yes
create mask = 0640
directory mask = 0750
hosts allow = 192.168.10.0/24
smb encrypt = required
server min protocol = SMB3_11💡 Use smb encrypt = desired on clients to force encryption only if the server supports it, but for sensitive data, require it server-side.
NFS exports should always use root_squash (maps root to nobody) or all_squash for untrusted clients. Never export to the world without subnet restriction. Use NFSv4 with Kerberos authentication (sec=krb5p) for integrity and privacy. Without Kerberos, NFS relies on UID matching, which is trivial to spoof. Export options like no_subtree_check (for reliability) and sync are essential.
⚠️ The Windows administrative shares (C$, ADMIN$) are hidden but exposed. Ensure only domain admins can access them, and disable them via registry if your policy allows.
Verify exercises to earn ★ 140 XP and unlock next lab level.