topic Re: SAMBA and IPTABLES... in Operating System - Linux

SAMBA and IPTABLES...

Leandro Sales — Mon, 03 Dec 2001 22:54:53 GMT

Hi, What other port should I allow to accept smb connection using IPTables? I??m allowing 137:139 just TCP?

/etc/services:
...
...
netbios-ns 137/tcp
netbios-ns 137/udp
netbios-dgm 138/tcp
netbios-dgm 138/udp
netbios-ssn 139/tcp
netbios-ssn 139/udp
...
...

Any clue?

Re: SAMBA and IPTABLES...

Leandro Sales — Mon, 03 Dec 2001 23:06:19 GMT

and 137:139 UDP ports too...

Re: SAMBA and IPTABLES...

Mark Fenton — Tue, 04 Dec 2001 01:00:09 GMT

As far as which ports should be allowed -- you've got it. Check your other configuration settings though, to ensure that you are allowing smb connections from the proper hosts/networks.

Re: SAMBA and IPTABLES...

Marco Paganini — Tue, 04 Dec 2001 04:34:51 GMT

Hello Leandro.

If you use iptables, you can use the 'state' modules to track the connection status for you. In that case, allow:

- any port -> udp or tcp 137, 138 and 139, connect status NEW,ESTABLISHED,RELATED

Hope it helps,
Paga

Re: SAMBA and IPTABLES...

Leandro Sales — Wed, 05 Dec 2001 21:51:43 GMT

Ok. I'm going to test tomorrow, now I can't do this...

Leandro.

Re: SAMBA and IPTABLES...

Mike Hassell — Thu, 06 Dec 2001 15:39:29 GMT

Leandro,

Looks like you've got everything you need to let netbios traffic into your samba (linux) host.

I just wanted to mention that I would be very cautious with this type of configuration if this server is directly connected to the internet as the security aspects of the SMB protocol are a bit weak to say the least. I assume that this machine is behind some other type of firewall, be it hardware or software, if this is the case, then I wouldn't worry as much, however if you're allowing incoming smb connections from the internet, be sure to monitor it very closely.

-Mike

Re: SAMBA and IPTABLES...

Leandro Sales — Thu, 06 Dec 2001 19:57:59 GMT

Hi Mike, Thanks...
The server that I use SAMBA has two interfaces for for Internal and another for a external network (Internet). I will allow incoming connection just for the internal interface, Any problem?

Re: SAMBA and IPTABLES...

Mark Fenton — Fri, 07 Dec 2001 02:33:54 GMT

Leandro,

When I was getting my SAMBA setup going a few months back -- I found the book from O'Reilly very helpful, especially the troubleshooting section:

http://www.oreilly.com/catalog/samba/chapter/book/ch09_01.html

I expect that you have already tried most of these steps already, but are still having trouble.

Since you are limiting your smb connections to your internal network -- in order to ensure that the smb distribution itself is not to blame, try allowing all services on the internal network (temporarily) and then step through shutting down services that are not needed/desired. This'll at least help to identify whether the problems you are facing are being generated by your IPTABLES rules originate from elsewhere.

hth