SMB File Share Plugin for Custom File Classification

This document explains how to configure the SMB File Share v1.0.0 plugin with the Custom File Classification (CFC) module of the Netskope Cloud Exchange platform. This plugin is used to pull images or zip files from provided directories present on a remote SMB server. The plugin supports the SMB protocol version from SMB 2.0.2 to SMB 3.1.1.

Prerequisites

To complete the configuration, you need:

• A Netskope tenant (or multiple, for example, production and development/test instances) that is already configured in Cloud Exchange.
• A Custom File Classifier on your Netskope tenant.
• A Netskope Cloud Exchange tenant with the Tenant plugin and Custom File Classification plugin already configured.
• Server with SMB setup and access with SSH service enabled to pull files.

SMB File Share Plugin Support

This plugin is used to pull images or zip files from provided directories present on a remote SMB server. The plugin supports the SMB protocol version from SMB 2.0.2 to SMB 3.1.1.

Permissions

This permission is needed for the plugin configuration: SSH User should have read access for the provided files.

From ..lib import smbclient

smbclient.register_session(
server,
username=configuration.get("smb_username"),
password=configuration.get("smb_password"),
port=configuration.get("smb_port", 445))

with smbclient.open_file(
remote_file_unc_path,
"rb"
) as remote_file:
with open(image_file_path, "wb") as file_object:
shutil.copyfileobj(remote_file, file_object)

try:
    file_stat = sftp_client.stat(self.csv_file_path)
    file_size = file_stat.st_size
    file_permissions = file_stat.st_mode
except FileNotFoundError:
    # Handle file not found error    pass

smbclient.reset_connection_cache()

Performance Matrix

Here is the performance reading conducted for fetching and storing 10K Files metadata ( ~5.4 MB each file size and total file size is ~52.5 GB) on a Large Cloud Exchange instance with these specifications.

Workflow

1. Get a shared path from the SMB Server.
2. Configure the SMB File Share CFC plugin.
3. Configure a Business Rule for SMB File Share.
4. Configure Sharing for SMB File Share.
5. Validation for SMB File Share CFC Plugin.

Watch a Video

Click here to watch a video.

Get Shared Directory from the SMB Server

SMB Server hosted in Windows

1. Run PowerShell as Administrator.

2. Run this command in the PowerShell:

   Get-SmbShare

Example Output:

Name	ScopeName	    Path
—--	 	---------		----
ADMIN$	*		        C:\Windows
C$		*         		C:\
MyShare	*         		C:\SMBShare

What It Means:

• Name: Share name
• Path: Actual folder location
• Shares ending with $ (like C$, ADMIN$) are hidden administrative shares

SMB Server hosted in Linux

1. Samba shares are defined inside /etc/samba/smb.conf

2. In Linux terminal, run: testparm -s

3. Look for sections like:

   [shared]
       path = /srv/samba/shared

4. Every section below [global] is a shared folder.

   [Documents]
       path = /home/devuser/docs

   This means:

   • Share name: Documents
   • Actual folder: /home/devuser/docs

SMB Server hosted in Isilon

1. Log in to the OneFS Web UI.

   

2. Go to Protocols and select SMB.

   

3. Open the Shares section.

   

4. You will see a list of configured SMB shares.

5. Look at the Path column. This shows the actual filesystem directory (usually under/ifs) that is shared via SMB.

   Example table:

   Share Name		Path
   test-share		/ifs/data/test
   Finance		    /ifs/data/finance

6. The Path value (/ifs/...) is the directory being shared.

Setup for Kerberos when using a Domain Name/FQDN instead of an IP Address

1. Install Kerberos Utilities Inside Core Container

   • Access the core container:

   docker exec -it -u0 <core-container> bash

   • Install Kerberos packages.
     • Ubuntu/Debian: apt update && apt install -y krb5-user smbclient
     • RHEL/CentOS: yum install -y krb5-workstation samba-client

2. Configure Kerberos (krb5.conf)

   • Create or update: /etc/krb5.conf
   • Add realm configuration:

   [realms]
      EXAMPLE.COM = {
          kdc = dc01.example.com
          admin_server = dc01.example.com
      }
   
   [domain_realm]
      .example.com = EXAMPLE.COM
      example.com = EXAMPLE.COM

   Note

   • Realm must usually be uppercase.
   • KDC should point to the domain controller.
   • DNS resolution must work correctly inside the container.
   • Replace these values:

   Placeholder	Replace With
   EXAMPLE.COM	Your AD/Kerberos realm
   dc01.example.com	Your Domain Controller / KDC hostname
   example.com	Your domain

3. Update the docker-compose.yml file.

   • Edit the docker-compose.yml file and add extra_hosts in core service:

   services:
   
    core:
   
      extra_hosts:
   
        - "<domain/FQDN>:<IP>"

4. Restart Cloud Exchange, and then configure the plugin with a domain name/FQDN of your SMB Server.

   sudo ./stop && sudo ./start

Configure the SMB File Share CFC Plugin

1. In Cloud Exchange, go to Settings > Plugin Store.

2. Search for and select the SMB File Share v1.0.0 (CFC) plugin.

   

3. Enter the Basic Information:

   • Configuration Name: Enter a name appropriate for your integration.
   • Sync Interval: Interval to pull the data from plugin source. We recommend keeping it longer than 12 hours. (Default: 12 hours)

   

4. Click Next and enter the Configuration Parameters:

   • Server IP/Hostname: Hostname or IP address of the SMB server from which the files are to be pulled.
   • Username: Username of the remote machine which has read access to shared directories.
   • Password: Password for the provided username.
   • Port: TCP port for SMB connection (default 445).

   

5. Click Next and enter the Directory Configuration parameters:

   You can add multiple directories in the SMB File Share Plugin.

   • Shared Directory: Name of the shared directory. Ensure that this directory name is present in the Network Path of the shared directory.
   • Directory Path: Path of the directory from which the files are to be pulled. This path must be relative to the shared directory.
   • Filename Filter: Regular expression that filters the files to be pulled based on their filenames. Ensure that the filter is a valid regular expression. If left empty, all files from the directory will be retrieved.
     • Empty value, pull all the files from directory.
     • The filter will only pull the images stored immediately in the directory.

   

6. Click Next and preview file scanning results for the configured directory. Ensure that the file count and size of files being pulled up by the plugin are correct and do not exceed the total file count limit (10,000) and total file size limit (~78.125 GB).

   

7. Click Save.

   

Configure a CFC Business Rule for SMB File Share

Custom File Classification module requires business rules to share file data to the Netskope Tenant. A user can add rules to filter files by name, size, extension, source, etc. Multiple rules can be grouped together for advanced filtering.

1. Go to Custom File Classification > Business Rules.

2. Click Create New Rule and enter these parameters:

   • Rule Name: A unique name for the business rule.
   • Rule: Set a filter based on conditions to make a group of files.
   • Folder Name: Provide a folder or sub-folder name to group multiple business rules. It will help to see a structured list of business rules in the table.

   

3. Click Save.

Configure Risk Exchange Sharing for SMB File Share

1. Go to Custom File Classification > Sharing.

2. Click Add Sharing Configuration and select the SMB File Share CFC plugin as the Source Configuration.

3. Select the Netskope CFC plugin as the Destination Configuration.

4. The Target will be selected by default, based on the Destination Configuration.

5. Select a Mapping for Business Rule, File Classifier, and Training Type. A user can map multiple business rules in one sharing. The File Classifier lists only custom file classifiers created on the Netskope Tenant.

   

6. Click Save.

Sync or Delete a Sharing Configuration

• Sync the sharing configuration by clicking on the synchronization icon. This starts the sharing process immediately, without waiting for the actual event to be triggered.
• Delete the sharing configuration by clicking on the garbage-can icon.

Validate the SMB File Share CFC Plugin

Validate the Pull

After the Sharing is configured, you should wait until the next plugin lifecycle run of the configured SMB File Share CFC plugin gets executed successfully.

Validate the SMB File Share Plugin status on the Sharing and Upload Management page. Go to Custom File Classification > Sharing and Upload Management.

The status of the Sharing configuration can be:

• Scheduled: This represents that the sharing is configured, but it is still in the queue and waiting to run for the first time.
• Generating Hash: This represents that the process of generating a hash is in progress.
• Uploading Hash: This represents that the hash is generated successfully, and the process of sharing it to the configured destination is in progress.
• Completed: This indicates that the generated hash is successfully shared with the destination configuration.
• Failed: Indicates that the process failed in either pulling data, hashing data, or uploading the hash.

Clicking View Metadata will redirect you to the Files Metadata page.

Pulling can be verified on Logging page in CE:

Validate Sharing on the Netskope Tenant

1. Log in to your Netskope Tenant.

2. Go to Policies > DLP > File Classifiers.

   

   

3. Select the Classifier that you have selected during the sharing configuration, you will see the file hashes received here:

   

Troubleshooting the SMB File Share Plugin

Unable to configure the SMB File Share CFC Plugin

Issue: If the user is unable to configure the SMB File Share CFC plugin, it may be due to one of these reasons:

• Incorrect credentials were provided.
• The user doesn’t have permission to read the file.
• Incorrect hostname/server IP.
• The provided port value is disabled on the Server.
• Incorrect directory path.

What to do: To solve these issues:

1. Make sure to provide the correct credentials.
2. Make sure that the user has the required permissions to read the file.
3. Make sure that the correct hostname/ server IP is provided.
4. Make sure that the port is enabled and in listening mode.
5. Make sure you have the image file data in the provided path.