Safe to expose samba fileserver publicly, or access through VPN?

Question

I have a Mavericks server running filesharing and VPN services through OSX server 3.2.2. My users connect to the VPN from the internet, then access the fileserver from within the private network. Recently, some changes to the network broke the VPN for windows clients. But, if I open ports TCP 139 (SMB) and TCP 548 (AFP) windows users can still access the filerserver (bypassing the VPN).
Is it safe to bypass the VPN and expose the fileserver directly? I've been able to find some information on security issues in samba, but it all seems pretty dated.

Answer 1

This isn't even a discussion, locally.  VPN.  Any other way just invites the riffraff to poke at the open ports, and even if there's no exposed passwords and no weak passwords, you're still going to get piles of log chatter as they poke and prod, and you're still potentially open to the discovery of a vulnerability in the protocol.
L2TP/IPSec is reasonably secure, with either two-factor or some decently-gonzo settings.  Traffic is also encrypted.
AFP data traffic was not encrypted, when last I checked.  The contents of the served files can be exposed to anyone with a privileged network position.
Local preference and local recommendations:  No open ports.  None.  Not unless there's an absolute need for specific ports to be open, such as a public-facing web server.  Everything (else) is VPN, usually into the firewall (with an integrated VPN server) or into a dedicated VPN server.  If you need public-facing ports open, put the host in a DMZ, and don't let any unintended traffic off that host either back to the Internet, or into your internal network.