'Hosts Allow' Section in smb.conf Overflows Parser

[Ken Stailey]

Hi,

We have an smb.conf with a long "hosts allow =" section. When I go to add more IP addresses to the right hand side of the assignment statement, running the testparam program reports:

ERROR: string overflow by 52 in safe_strcpy [10.253.11.110 10.254.161.101 10.254.161.102 10.254]

This appears to indicate that the "hosts allow" is choppped off by 52 bytes. Changing the length of the list makes the "52 bytes" get larger or smaller.

I've taken out all the whitespace (tabs, blanks, etc) that I can but the list I need doesn't fit. Is there any strategy for getting more entries to fit?

Thanks

[Sean Dale · Accepted solution]

You can use the following to allow servers/hosts that are in the same network:

Allow all IPs in 199.299.*.*
hosts allow = 199.299.

Or, you can allow hosts that match the given network/netmask:

hosts allow = 199.299.19.0/255.255.255.0

If you have a list of hosts that are in the same network, you could certainly shorten the list.

You can also specify hosts netgroup names if your system supports netgroups.
For example, you could allow only hosts in netgroup "mynetgroup"

hosts allow = @mynetgroup


you would then list the allowed hosts in the group mynetgroup, or whatever you call it.

[Sean Dale]

A name starting with a ´@´ is interpreted as an NIS netgroup first (if your system supports NIS) and then as a UNIX group if the name was not found in the NIS netgroup database.

A name starting with ´+´ is interpreted only by looking in the UNIX group database.

A name starting with ´&´ is interpreted only by looking in the NIS netgroup database (this requires NIS to be working on your system).

The characters ´+´ and ´&´ may be used at the start of the name in either order so the value "+&group" means check the UNIX group database, followed by the NIS netgroup database and the value "&+group" means check the NIS net group database, followed by the UNIX group database (the same as the ´@´ prefix).

[Ken Stailey]

Thanks for the suggestions. I wish I could just turn on NIS just like that but this is production system with change management so I'd have to do a lot of work to promote the idea in order to get approval.

I did notice that some of the IP address in the "hosts allow=" ACL do not respond to ping so I will first try to "garbage collect" them and see if the new additions can fit.

[Sean Dale]

You could always use a unix group to define all the hosts you want to grant access to then use +groupname in the cnf file. That way you have one entry instead of a very long text string.

[Christian Schulze]

Hi Ken,

How long was your hosts allow line?

I am asking, because we are using this feature excessiveliy in our environment.

This would help me to do some things in advance before I really hit this problem.

Christian

[Ken Stailey]

It has to be a bit more than 1140 bytes since that's what's working now. Somewhere around 1202 - 1216 bytes.