
# aCloud

## Introduction {#introduction}

In this project I created SMB server at home, so I can store
files in the server, and access them from any computer (that is connected to home wifi).
Additionally, I created different users, each of which has access to his own folder.
This page is an overview of the hardware that was used in this project.
There are also [SSH](/Projects/CS/secure-ssh) and [Samba](/Projects/EE/samba) pages where I explain
how to configure secure connection via SSH, enable SMB server using samba,
and manage users.

***

## Hardware {#Hardware}

While working on the idea, I planned on using Raspberry Pi 4 with 8GB RAM.
However, this board was not available because of supply chain crisis (2022).
So I searched for another board that is similar, and found one with NVMe port,
so theoretically is faster than USB 3.0. Unfortunatley, this board was also not available,
so I kept searching until I found [ROC-RK3328-CC (Renegade)](https://libre.computer/products/roc-rk3328-cc/). This board has 4GM RAM and a USB 3.0 port, so performace was compromised. Here is a list of all hardware components for that project:



1. [ROC-RK3328-CC (Renegade)](https://libre.computer/products/roc-rk3328-cc/) - SBC board with 4GB RAM, USB3.0, HDMI, microSD card slot, etc.

1. 1TB 2.5-inch SSD with SATA connection

1. SATA to USB3.0 cable

1. MicroSD card (64GB)

1. RPi case with a cooling fan (optional)

1. Ethernet connection

1. HDMI (only required for the installation)

1. MicroUSB (power source)

![hardware {400x600} {caption: Hardware.}](acloud/hardware.png)

---

## Flashing OS on SD Card {#Flash}

At first I installed Ubuntu 22.04 because I thought it is more stable than Raspbian, but this was a mistake.
Ubuntu was very slow, and it never gotten any faster. Also, there were many bugs, such as USB port doesn't work, and
a black screen when using GNOME to share screen. Then I deleted Ubuntu and installed Raspbian, and I was surprised by
how faster it is than Ubuntu. To flash OS on an SD card, you need to download the [OS Image](https://libre.computer/products/roc-rk3328-cc/) and you can either use terminal (dd command), or a program to flash image on the SD card. I recommend using [balenaEtcher](https://www.balena.io/etcher/), very easy and quick.

---

## Server Installation {#install-os}
- **SSH -**
    Once the OS image is installed on the SD Card, you can connect it to the board. A keyboard, a mouse, Ethernet and HDMI connections are also required
    until SSH is configured. Then, turn on the board using microUSB port and installation process should appear on the connected screen. Once completed, I recommend
    enabling and configuring SSH to enable remote connection, so the HDMI, keyboard and mouse are no longer required. To make it more secured, I recommend
    configuring SSH to keys only, so access with password will be denied. More details in [SSH](/Projects/CS/secure-ssh) page.

- **Format Disk -** 1TB of storage was utilized in this project, but in order to allow various users to access different directories, the disk
must be formatted as ext4 (could also be nfts, but didn't test it) for compatability with Linux (Raspbian is based on Linux).
At first, the disk was formatted as ExFAT on my mac because it was an easy process, but it was a mistake. In this case, read and write could
done by only one user. Trying to change ownership (chown command) and change permissions (chmod command) didn't work at all. ExFAT is compatible
with Windows, and therefore Linux cannot change either ownership or permissions.
For that purpose, I used [gparted](https://gparted.org) which is a program to manage partitions.
Another option is to use terminal, but gparted has a great GUI (Graphic User Interface), so it is easier to avoid critical mistakes.

- **Samba -** [Samba](https://www.samba.org/samba/) is a free tool that provides file and print sharing services.
There could be many users with access to different folders within the shared disk. The users access the server
with their username and password which are, currently, generated by the root user through an SSH connection.
Samba was also configured to send an email for both connecting to and disconnecting from the server. More on that in the Samba page.

- **Sharing Screen (Optional) -** This step is not necessary since almost everything can be done through SSH. However, it might be more convenient
to be able to control the server from another computer by sharing the screen. While looking for services, I noticed that
Raspbian uses a tool that is subscription based. So I searched for a free tool and found [DWS](https://www.dwservice.net) and is very easy to use.
Simply downloaded Raspberry version (.sh file) and copied it to the server. To share screen, the file must be executed on terminal which will
create a session and generate temporary username and password. On local machine, go to dws and enter username and password to gain full control.
To prevent access from hackers, the .sh file was encrypted with password using [GnuPG](https://www.gnupg.org/documentation/manpage.html).

---

## Accessing Server {#access}

- *SSH -*
    ```shell
        ssh user@IP_Address
    ```
- *Samba -*
    To start the server, on terminal run the following:

    ```shell
        sudo service smbd start
    ```

    This will enable a new connection under Network (on Mac). It will ask for username and password, so directories
    will be accessible based on the user that logged in.


---

## Performance {#performance}

Read and write speeds in the server are around 340MB/s and 80MB/s respectivley
as shown in the images below:

![read speed server {630x81} {caption: Read Speed Test}](acloud/read_speed.png)


These test results follows the expected values of read/write speeds of USB3.0.
However, the same test should be done on another machine connected to the Samba server in order to evaluate speed over the internet.

![write spped samba {604x78} {caption: Write Speed Test Over Internet}](acloud/write_samba.png)

As can be seen in the images above, performance is worse than the one performed on the server itself.
Over the internet, read speed is 11,587,146 bytes/second which is ~11 MB/s, and write speed 10,101,961 bytes/second which is ~9.6 MB/s.
This test shows that both writing to and reading from this server don't max out the read and write speeds of USB3.0.
With that in mind, choosing NVMe over USB3.0 would probably not affect this test much.
Instead, better network speeds, as well as greater RAM will probably increase performance.

---

## Summary {#summary}

Server is up and running, email notifications for both SSH and Samba are working well, so I get notified in real-time. The goal of the project was achieved, as I wrote those lines by connecting to the Samba server remotley.Read and write speeds are slower than those evaluated on the server, but it is good enough since I am using it for files that are small in size such as Python projects, or storing pdf documents.


aCloud



# Samba Connection

## Introduction {#introduction}

Samba is a free tool for sharing files through network and also enables user management. It comes pre-installed in Raspbian, so installation part is not covered in this guide.
In this project, I followed [user creation guid (jaunerg)](https://superuser.com/a/1400920) in order to create two users and shared different folders, so one user doesn't affect the other. Additionally, I used bash code (.sh files) similar to the one I used in the [SSH](/Projects/CS/secure-ssh) page in order to send email notifications.

***

## Add a user {#users}

1. To add a user to Samba, the user must also be registered in the OS:

    ```shell
    sudo adduser --no-create-hom --shell /usr/sbin/nologin USERNAME
    ```
1. Add and enable user in Samba using smbpasswd:
    ```shell
    sudo smbpasswd -a USERNAME
    sudo smbpasswd -e USERNAME
    ```

1. Assign user to a group. If the group doesn't exist, then create one:
    ```shell
    # Create group
    sudo groupadd GROUP

    # Assign user to a group
    sudo usermod -G GROUPS USERNAME
    ```

    Here GROUPS must be replaced with all the groups we would like to assign to USERNAME.
    This operation overrides previous ones, so if you want to
    assign a user to a few groups, you must list them above (comma-separated).


1. Create a directory that will be shared with this user and change its group:


    ```shell
    # Create directory
    sudo mkdir PATH_TO_DIRECTORY

    # Change group
    sudo chown root:GROUP PATH_TO_DIRECTORY
    ```

    **Note:** You can also change permissions with chmod command,
    but it can be configured in Samba configuration file.

1. Add users to Samba configuration file.

    Before doing so, make sure you have a copy of the original file (backup):
    ```shell
    sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.backup
    ```

    You can use "ls" command to verify backup exists:
    ```shell
    sudo ls /etc/samba/
    ```

    Then open config file as super user:
    ```shell
    sudo nano /etc/samba/smb.conf
    ```

    And append the new shared folder to the end:
    ```shell
    [SHARE_NAME]
        comment = Shared folder called SHARE_NAME
        path = PATH_TO_DIRECTORY
        browseable = yes
        read only = no
        guest ok = no   # No guests allowed
        create mask = 0777  # Can change permissions here
        directory mask = 0777   # Directory permissions here
        writable = yes
        valid users = USERNAME  # List of users that are
                                # allowed to access this directory
        force user = USERNAME   # Default user assigned when connecting to this share
    ```

    For more information on smb.conf, visit [Samba documentation](https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html)

6. Restart samba and try to log in:
    ```shell
    sudo service smbd restart
    ```

---

## Email Notification (Optional){#email}
This step is crucial for monitoring Samba sessions and enhance security.
Samba has a few [variables (VARIABLE SUBSTITUTIONS)](https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html) we can utilize in order to create log files
Email notifications are sent for each login to or logout from a shared directory, so it allows a quick response in case that someone penetrated the server.
Additionaly, you will need an email service that allows third party apps (app password in Gmail). I also tried Yahoo, but their third party service is down.

1. Open terminal in /usr/local/bin/ directory.

     or open terminal and run the following Command
    ```shell
    cd /usr/local/bin
    ```


1. Create a new .sh file (email_temp.sh):
    ```shell
    sudo nano email_temp.sh
    ```
    This is the template of the email. You can change it according to your needs.
    ```shell
    echo 'From: Samba Connection &lt;sender_email&gt;\n'\
            'To: avivfaraj &lt;receiver_email&gt;\n'\
            'Subject: '$1 '\n\n'\
            $2 	&gt; /usr/local/bin/samba_email.txt
    ```

    This code will create the email_template (samba_email.txt) inside /usr/local/bin/ directory. Note that $1,$2 mean the first and second parameters sent while executing file.
    For example:
    ```shell
    sh email_temp.sh "First parameter" "Second parameter"
    ```
    This code will create a .txt containing "Subject: First parameter" and the content will be "Second parameter"

1. Create a new .sh file (send_email.sh):
    ```shell
    sudo nano send_email.sh
    ```
    This code will send the email using the curl command:
    ```shell
    curl --ssl-reqd \
        --url 'smtps://smtp.gmail.com:465' \
        --user 'SENDER_EMAIL:PASSWORD' \
        --mail-from 'SENDER_EMAIL' \
        --mail-rcpt 'RECEIVER_EMAIL' \
        --upload-file /usr/local/bin/samba_email.txt
    ```
    Replace SENDER_EMAIL and RECEIVER_EMAIL with email addresses. Also, the PASSWORD should be replaced with the app password.


    **Note:** It is a better practice to use envorinment variables in the code, so instead of writing sensitive information such as password in the file,
    it is better to read a variable that is defined locally. However, I tried to do so, and it didn't read the variable at all, so login was denied.

1. Create another .sh file that will execute the above .sh programs and send an email for each connection or disconnection:
    ```shell
    sudo nano custom_log.sh
    ```
    In the file write the following code:
    ```shell
    msg=''
    title=''
    if [ $1 -eq 2 ]; then
        msg="Connected to"
        title="Samba connection established"
    else
        msg="Disconnected from"
        title="Samba Disconnected"
    fi

    if [ $1 -eq 2 ] || [ $1 -eq 3 ]; then
        mailcontent="${2} ${3} - ${msg} ${4} on ${5} by ${6} at ${7} os ${8} using ${9} ip ${10}"
        echo "${mailcontent}" >> /usr/local/bin/history.log
        sh /usr/local/bin/mail_temp.sh "$title" "$mailcontent"
        sh /usr/local/bin/send_email.sh
    fi
    ```
    Note that $1 can be either 2 for
    connection or 3 for disconnection.

1. Finally, add __root prexec__ and __root postexec__ parameters under the shared folder in /etc/samba/smb.conf:

    ```shell
    root preexec = sh /usr/local/bin/custom_log.sh 2 %T %S %h %u %m %a %R %I
    root postexec = sh /usr/local/bin/custom_log.sh 3 %T %S %h %u %m %a %R %I
    ```
    Those parameters are executed as root at
    login (preexec) and logout (postexec).
    Please note that you can place them under
    [global] (without the root) in order
    to affect all users, but it didn't work as expected.
    In other words, both preexec and postexec
    were executed at login. Therefore, I place
    these two lines under every share I create
    as can be seen in the code below:

    ```shell
    [SHARE_NAME]
        comment = Shared folder called SHARE_NAME
        path = PATH_TO_DIRECTORY
        browseable = yes
        read only = no
        guest ok = no   # No guests allowed
        create mask = 0777  # Can change permissions here
        directory mask = 0777   # Directory permissions here
        writable = yes
        valid users = USERNAME  # List of users that are allowed to access this directory
        force user = USERNAME   # Default user assigned when connecting to this share
        root preexec = sh /usr/local/bin/custom_log.sh 2 %T %S %h %u %m %a %R %I
        root postexec = sh /usr/local/bin/custom_log.sh 3 %T %S %h %u %m %a %R %I
    ```
    Also, %T, %S, %h, etc. are all samba variables,
    for instance,%T is time and date. Please note that
    %T is unique since it returns two values:
    one for date, and one for time. It means that $2, $3 in custom_log.sh represent date and time respectively.



Engineering Projects

aCloud

Samba Configuration