LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 07-01-2004, 12:56 PM   #1
HedAche
LQ Newbie
 
Registered: Jul 2004
Location: London, UK
Distribution: Kubuntu 8.04 & OpenSuse 11.0
Posts: 5

Rep: Reputation: 0
banning IP addresses in samba


Hi all,

I run Mandrake 10.0 in a building where 99% of users run some version of Windows. Every couple of days the printer attached to my machine starts printing meaningless garbage (!!) consisting of a seemingly random selection of symbols across the top few lines of each page. The user connecting to my machine isn't supposed to be - he's in a completely different office etc - and I want to be able to prevent his machine from connecting to mine and running these print jobs. When i do ps -aux the relevant entry is as follows:

root 3117 0.1 0.3 3072 816 ? S 16:40 0:01 parallel:/dev/lp0 23 jonck smbprn.00000028 Remote Downlevel Document 1 /var/spool/cups/d00023-001

I also know the guys IP address from the samba log file - is it possible to prevent just this machine from connecting with this info?

Many thanks in advance.
 
Old 07-01-2004, 01:40 PM   #2
david_ross
Moderator
 
Registered: Mar 2003
Location: Scotland
Distribution: Slackware, RedHat, Debian
Posts: 12,047

Rep: Reputation: 64
Welcome to LQ.

You can do it in smb.conf with "hosts deny" - ie:
hosts deny = somepc

or by IP:
hosts deny = 192.168.1.1

For more details see:
man smb.conf

You may also want to contact the person in question. It sounds like they have the BugBear virus.
 
Old 07-01-2004, 11:33 PM   #3
ppuru
Senior Member
 
Registered: Mar 2003
Location: Beautiful BC
Distribution: RedHat & clones, Slackware, SuSE, OpenBSD
Posts: 1,791

Rep: Reputation: 47
Alternative to david ross' suggestion

you can control the same using tcp wrappers. edit /etc/hosts.deny

smbd: <IPs you don't want to give access to>

You won't have to reload samba each time you add an ip to the banned list.

Last edited by ppuru; 07-01-2004 at 11:34 PM.
 
Old 07-02-2004, 03:40 AM   #4
HedAche
LQ Newbie
 
Registered: Jul 2004
Location: London, UK
Distribution: Kubuntu 8.04 & OpenSuse 11.0
Posts: 5

Original Poster
Rep: Reputation: 0
David - many thanks; I was going to contact the person who keeps connecting but he is about 85 and barely knows what a PC is (i work in an academic dept. where we have lots of yoda-types like him) - as you say it may well be BugBear; we have been hit v hard by a gamult of viruses doing a variety of things to pcs - this is one fo the reasons i am now using linux at work and trying hard to convince the IT guys to do the same (they're not the most switched on dudes in the world...)
 
Old 07-02-2004, 05:01 PM   #5
david_ross
Moderator
 
Registered: Mar 2003
Location: Scotland
Distribution: Slackware, RedHat, Debian
Posts: 12,047

Rep: Reputation: 64
If you do contact him then there is a good removal tool available with instructions from symantec:
http://securityresponse.symantec.com...oval.tool.html

I'm 99% sure that it will be bugbear.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
SAMBA and IP Addresses drevil666 Linux - Newbie 5 07-01-2005 03:09 PM
MEPISlovers banning certain people? galen Linux - Distributions 10 12-15-2004 01:47 AM
using 2 ip addresses Laimonas16 Linux - Networking 0 09-21-2004 06:45 AM
banning an IP digsby0007 Linux - Security 11 02-27-2004 01:02 AM
banning an ip im1crazyassmofo Linux - General 18 04-10-2003 11:07 AM


All times are GMT -5. The time now is 11:25 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration