samba behind firewall: which ports open?

[Donald Kok]

Hi there,
One of my servers acts as a samba server in a domain, which is on a different LAN. The network adminstrators there decided to deploy a firewall. They decided to shut all ports, and announced to open ports on request. The request will take a week to complete.

So now I need to request the opening of the ports required for samba. I want to do this right the first time, since each request takes a week.

This is what I came up with:

- 137,138,139: usual nns ports
- 42: wins announcements
- 53: dns

Is there anything I miss? (perhaps a port for validating passwords?

Thanks in Advance!
Donald

[U.SivaKumar_2 · Accepted solution]

Hi,

Let me more specific ..

Open port 137 , 138 , 139 both udp and tcp.

Open tcp port 42.

Open udp port 53.

Use only the latest version of samba .

Read this news about samba before proceeding.

"Digital Defense, Inc. has alerted the Samba Team to a serious vulnerability in all stable versions of Samba currently shipping. The Common Vulnerabilities and Exposures (CVE) project has assigned the ID CAN-2003-0201 to this defect.

This vulnerability, if exploited correctly, leads to an anonymous user gaining root access on a Samba serving system. All versions of Samba up to and including Samba 2.2.8 are vulnerable. An active exploit of the bug has been reported in the wild. Alpha versions of Samba 3.0 and above are *NOT* vulnerable.

The 2.2.8a release contains only updates to address this security issue. A rollup patch for release 2.2.7a and 2.0.10 addressing both CAN-2003-0201 and CAN-2003-0085 can be obtained from this directory.

The source tarball is available in both gzip format and bzip2 format. The uncompressed tarball signature should also be downloaded to verify the archive's integrity. Here is the Samba Distribution Key for verifying the tarball. Finally, here is the patchfile against 2.2.8 (signature)."

regards,
U.SivaKumar