samba and symlinks

[sk1887]

I've recently upgraded to Merlin's Build 374.33 Beta 1
I've been using his firmwares in a while.

anyway. this last build denies me accessing symlinks through samba shares or through http.

I was used to symlink my torrent download folder to a nginx share so I could acces files over my web page, now i can't anymore, either through normal samba browsing or through http.
Any clue on to solve this?

adding this to smb.conf

follow symlinks = yes
wide links = yes
unix extensions = no

should do the trick as reported around the web, yet the smb.conf configuration seems to regenerate through boots or samba restarts.

 

[RMerlin]

I've recently upgraded to Merlin's Build 374.33 Beta 1
I've been using his firmwares in a while.

anyway. this last build denies me accessing symlinks through samba shares or through http.

I was used to symlink my torrent download folder to a nginx share so I could acces files over my web page, now i can't anymore, either through normal samba browsing or through http.
Any clue on to solve this?

adding this to smb.conf

follow symlinks = yes
wide links = yes
unix extensions = no

should do the trick as reported around the web, yet the smb.conf configuration seems to regenerate through boots or samba restarts.

wide links is disabled by the firmware in recent versions, for security reasons. Otherwise, anyone could plug in a flash drive with a symlink on it, and gain unrestricted access to anything on your router. From there it would be come trivial from anyone to gain root access on your router.

Now that Asus has also released a version that includes the fix (374.720), here are the details on the security issue:

http://www.samba.org/samba/news/symlink_attack.html

 

[sk1887]

yes, I understand. Has Asus just realized this now?
So is there an alternative for my needs? In my web server folder I want a symlink to avoid copying files I have in another folder.
example: hostname.com/downloads/file.rar
where downloads is a symlink to /mnt/sda1/torrents/downloads

I hope there is a secure way around this I hope I won't have to duplicate files!

I also thought of changing the nginx root folder, but it seems a bit insecure as well.