LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 04-13-2004, 08:25 AM   #1
jeffreybluml
Member
 
Registered: Mar 2004
Location: Minnesota
Distribution: Fedora Core 1, Mandrake 10
Posts: 405

Rep: Reputation: 30
Firewalls and Samba


Hi,

Just closed a really long thread trying to get my linux box's printer installed on my networked wondows box, and after days of fighting I found out my linux firewall was what was holding me back. Once I disabled the firewall, I am able to browse my linux box from windows. Cant print yet (though I was able to find and install the printer from windows...just doesn't actually print when asked) but I can browse and write from windows to linux.

Currently, I have my firewall disabled still. I am behind a linksys router, but I'm running a webserver and sshd on my linux box, so I'd be more comfortable if I had the firewall up. I had tried to open ports 137, 138, and 139 through iptables, but have NO idea if I did it correctly. These are in fact the ports needed for windows to unix samba sharing, aren't they? Here's my iptables, into which I manually entered the lines for the aforementioned ports:

Oops, iptables is now gone from /etc/sysconfig!!!!! Is that because the firewall is disabled? I'll assume so. Here is what it said when it was up:


------------------------------------------------------------------------------------------------
# Firewall configuration written by redhat-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 137 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 138 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT
COMMIT
-----------------------------------------------------------------------------------------------


I really assume I entered the lines for ports 137-139 wrong. I just copied the line for port 80, which I realize isn't the correct way to do it.

Will somebody please let me know how to PROPERLY open the needed ports for samba sharing? What ports, and what command opens them?

THanks!
 
Old 04-13-2004, 08:47 AM   #2
hazza
Member
 
Registered: Nov 2003
Location: Australia
Distribution: Mandrake, SUSE, Fedora
Posts: 122

Rep: Reputation: 15
The last three rules will not match anything because the fourth last line rejects everything. As for what are the correct ports use "netstat -lnptuw" to find out what samba is listening on and open them up. Move the fourth last rule to the bottom.

The ports that samba listens on are 137/udp, 138/udp, 139/tcp and 445/tcp. I would suggest not editing /etc/sysconfig/iptables directlly is hazardous as one mistake can leave you without a firewall. It is better to modify it with the iptables command and save it with "service iptables save".

Last edited by hazza; 04-13-2004 at 09:04 AM.
 
Old 04-13-2004, 09:23 AM   #3
jeffreybluml
Member
 
Registered: Mar 2004
Location: Minnesota
Distribution: Fedora Core 1, Mandrake 10
Posts: 405

Original Poster
Rep: Reputation: 30
Thanks for the reply...

I am running fedora core 1, and both "iptables" and "service" give "command not found"

Is there another command I can use? I am not at home, but can do most by ssh. How would a person start (or restart) his firewall via command line if typing service gives command not found?

THanks,
 
Old 04-13-2004, 10:11 AM   #4
hazza
Member
 
Registered: Nov 2003
Location: Australia
Distribution: Mandrake, SUSE, Fedora
Posts: 122

Rep: Reputation: 15
Having both iptables and service turn up as not found would mean that /sbin is not in your path. You have to run them as root but somethimes using su to login as root doesn't set the path. So if they're not in you path then use "/sbin/iptables" and "/sbin/service". If you login in as root using "su -l" it should setup the PATH variable for you properly.
 
Old 04-13-2004, 10:41 AM   #5
hazza
Member
 
Registered: Nov 2003
Location: Australia
Distribution: Mandrake, SUSE, Fedora
Posts: 122

Rep: Reputation: 15
Considering the configuration you've described here's one way to setup your firewall:

Clear out the old firewall by running the following as root:

# /sbin/iptables -F
# /sbin/iptables -X

Setup the new firewall:

# /sbin/iptables -A INPUT -j ACCEPT -i lo
# /sbin/iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED
# /sbin/iptables -A INPUT -j ACCEPT -m state --state NEW -p icmp --icmp-type echo-request
# /sbin/iptables -A INPUT -j ACCEPT -m state --state NEW -p tcp --dport 22 --syn
# /sbin/iptables -A INPUT -j ACCEPT -m state --state NEW -p tcp --dport 80 --syn
# /sbin/iptables -A INPUT -j ACCEPT -m state --state NEW -p udp --dport 137
# /sbin/iptables -A INPUT -j ACCEPT -m state --state NEW -p udp --dport 138
# /sbin/iptables -A INPUT -j ACCEPT -m state --state NEW -p tcp --dport 139 --syn
# /sbin/iptables -A INPUT -j ACCEPT -m state --state NEW -p tcp --dport 445 --syn
# /sbin/iptables -A INPUT -j REJECT -p tcp --reject-with tcp-reset
# /sbin/iptables -A INPUT -j REJECT -p udp --reject-with icmp-port-unreachable
# /sbin/iptables -P INPUT DROP
# /sbin/iptables -P FORWARD DROP
# /sbin/iptables -P OUTPUT ACCEPT

Add the following line to /etc/sysconfig/network to stop the scripts from modifying your custom firewall:

FIREWALL_MODS=no

Finally you save your firewall configuration to /etc/sysconfig/iptables and enable it with:

# /sbin/service iptables save
# /sbin/chkconfig iptables on

Last edited by hazza; 04-13-2004 at 10:43 AM.
 
Old 04-13-2004, 11:37 AM   #6
jeffreybluml
Member
 
Registered: Mar 2004
Location: Minnesota
Distribution: Fedora Core 1, Mandrake 10
Posts: 405

Original Poster
Rep: Reputation: 30
hazza! I cannot thank you enough! That is exactly the kind of help (or handholding) I needed!

Not home, so now way of konwing if it worked, but it let me enter all the commands, and started the service okay, so I'll assume for now that it did.

How can I add sbin to my path? I'd like it done for all users, so which file do I put it in and what do I put there?

Thanks again, you are a very good person...

Gotta love LQ...
 
Old 04-13-2004, 02:34 PM   #7
jeffreybluml
Member
 
Registered: Mar 2004
Location: Minnesota
Distribution: Fedora Core 1, Mandrake 10
Posts: 405

Original Poster
Rep: Reputation: 30
Come to think of it, can somebody please outline for me the following:

1) In what file(s) does one define the paths that will be used for finding commands?

2) What are ALL the paths that should be listed there? If sbin is not in my path (which apparently it isn't), I assume there may be other paths not listed as well, so can somebody give me an example of all the useful paths?

Thanks in advance!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
samba and firewalls geletine Linux - Networking 4 05-16-2005 11:20 AM
samba, firewalls and pinging davidk Linux - Newbie 14 10-27-2004 11:23 PM
Samba and firewalls on Linux/Windows network - where to start? abovett Linux - Security 9 06-21-2004 07:18 PM
firewalls anyone? BajaNick Linux - General 0 02-05-2004 10:08 PM
Linux Firewalls [iso firewalls] yoogie Linux - Networking 3 01-28-2002 07:56 PM


All times are GMT -5. The time now is 02:52 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration