LinuxQuestions.org
Support LQ: Use code LQ3 and save $3 on Domain Registration
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices



Reply
 
Search this Thread
Old 02-06-2003, 10:29 AM   #1
kif
LQ Newbie
 
Registered: Feb 2003
Posts: 3

Rep: Reputation: 0
Question bind named and samba to local interfaces


I've just installed RH 8.0 to act as a gateway for my home LAN and I'm now doing the basic security thing - closing all the ports not in use, and setting the ones that are to only bind to the LAN interfaces.

I'm almost done, but I've a couple of questions about services that I can't seem to set to ignore the external interface.

- In named.conf I've set listen-on to the local interfaces. But, while netstat shows that it is bound to them on 53/tcp and 53/udp, it still reports named as also listening on 1024/udp. Am I missing something, or does named need this extra udp port open?

- I'm also running samba, and in smb.conf I've again set the interfaces to the local net and set "bind interfaces only" as well.
Netstat (and fuser) show me that the smbd bit of samba is bound only to my LAN on 139/tcp but that nmbd is bound twice on both 137/udp and 138/udp - once to the local interfaces and again on all interfaces. How can I get rid of the extra bindings?

Why is tcp behaving as I want it to, but not udp? Why do we need both protocols anyway?

cheers
 
Old 02-06-2003, 06:15 PM   #2
peter_robb
Senior Member
 
Registered: Feb 2002
Location: Szczecin, Poland
Distribution: Gentoo, Debian
Posts: 2,458

Rep: Reputation: 47
It appears that port 1024 is used for a "back-channel"
https://support.algx.net/cst/dns/FAQservers.html#q3 refers...
 
Old 02-06-2003, 06:46 PM   #3
kif
LQ Newbie
 
Registered: Feb 2003
Posts: 3

Original Poster
Rep: Reputation: 0
thanks - so if I want to receive any replies to my DNS queries, the udp ports above 1023 have to remain open. That page also says that I shouldn't filter 53/udp traffic either - but that port is only bound to my local interfaces (eth0 and lo) and DNS is working. What gives?

I'm also guessing that the double entries for nmbd are from misconfiguration, so I'm rechecking the samba config.
 
Old 02-06-2003, 07:49 PM   #4
peter_robb
Senior Member
 
Registered: Feb 2002
Location: Szczecin, Poland
Distribution: Gentoo, Debian
Posts: 2,458

Rep: Reputation: 47
Usually, if you have iptables running, the conntrack mechanism will track the back-channel and allow it for you.
The comment in the link refers to older firewall styles that blanket block udp ports, making the newer dns fail...
So, if you don't have any dns problems, you are seeing the port was used by named as a back-channel. It may stay in the conntrack list for several hours,depending on the timeout period for udp ports.
Have a blanket udp block if you use iptables

smb uses a combination of udp and tcp ports.
tcp for name resolution and udp for data. three ports in total, 137, 138 & 139.
There isn't any way to restrict the 0.0.0.0:137 & 0.0.0.0:138 udp entries.
If, of course, I am wrong, I get to taste my woolen hat, again.
It really doesn't matter if the box is listening, so long as you control the ports with rules, & -j LOG entries, to be sure.

Have you seen this tutorial?
 
Old 02-07-2003, 07:34 AM   #5
kif
LQ Newbie
 
Registered: Feb 2003
Posts: 3

Original Poster
Rep: Reputation: 0
That looks to be one of the better tutorials I've seen on iptables - I am running that at the moment, it's just with a mix of sample rules I've found elsewhere on the net. I will end up writing my own config - probably dropping everything I don't explictly allow - but I'd rather there wasn't anything listening on a port in the first place.

I'm surprised that samba wants to bind to the external interface - I don't plan on offering windows shares over the internet, and imagine anyone not running a WAN would want to either. I must be missing something, but I don't know what...

cheers
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
BIND -named.conf ryanc75 Linux - General 3 09-19-2005 03:57 AM
cant get bind/named to work! please help! gsgleason Slackware 2 10-23-2004 02:56 PM
bind and named Red Squirrel Linux - Software 3 04-25-2004 10:49 PM
BIND / named r3ekon Linux - Newbie 6 10-16-2003 06:33 PM
Bind / named 80s Linux - Networking 3 03-20-2003 08:47 AM


All times are GMT -5. The time now is 12:24 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration