Samba - Windows client cannot connect to Linux Server.

nathacof · 02-10-2008, 11:37 AM

I'm having a problem connecting from a Windows client to my home Samba server.

Code:

> testparm /etc/samba/smb.conf
[global]
        workgroup = MYGROUP
        server string = Samba Server @ dev.neranjara.org
        log file = /var/log/samba.%m
        max log size = 50
        dns proxy = No
        valid users = nathacof
        hosts allow = 192.168.1., 209.41.163.23

[homes]
        comment = Home Directories
        read only = No
>

When I attempt to connect from my Windows workstation and enter my password from work I'm getting thrown back to the authentication prompt, whereas from home I can connect with out issue.

My Router has the following ports forwarding to the Samba server:

Code:

 Port 135/TCP
 Port 137/UDP
 Port 138/UDP
 Port 139/TCP
 Port 445/TCP

root@dev:/var/log# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
root@dev:/var/log#

As per the instructions here, http://samba.org/samba/docs/man/Samb...#firewallports.

So since I'm able to connect to the remote server, and it prompts me for authentication, I would assume I'd be able to check the logs for this particular connection.

But when I check the logs for this host they do not exist:

Code:

root@dev:/var/log# ls -l /var/log/ | grep samba
drwxr-xr-x 3 root   root       4096 2007-08-19 12:16 samba/
-rw-r--r-- 1 root   root          0 2007-10-08 18:58 samba.0.0.0.0
-rw-r--r-- 1 root   root       7956 2008-02-09 20:31 samba.192.168.1.100
-rw-r--r-- 1 root   root        408 2008-02-09 00:04 samba.192.168.1.101
-rw-r--r-- 1 root   root      16452 2008-02-08 13:18 samba.192.168.1.102
-rw-r--r-- 1 root   root       3876 2008-02-09 02:02 samba.192.168.1.103
-rw-r--r-- 1 root   root          0 2007-08-28 20:19 samba.192.168.1.104
-rw-r--r-- 1 root   root          0 2008-02-07 21:00 samba.192.168.1.80
-rw-r--r-- 1 root   root          0 2008-02-07 21:00 samba.dev
-rw-r--r-- 1 root   root        153 2008-02-10 11:49 samba.smbd
root@dev:/var/log#

Any one know what the heck is going on here?

jgombos · 02-11-2008, 02:21 PM

Is it valid to have a partial IP ("192.168.1.") in the hosts allow config?

nathacof · 02-11-2008, 04:42 PM

Appears to be. As I said I can connect from home, and it works fine, using that subnet. As a matter of fact it was included in the default smb.cnf file.

The problem is with the connection from the external IP.

billymayday · 02-11-2008, 04:46 PM

Does you work firewall let the necessary ports access?

bassel · 02-11-2008, 05:41 PM

I think you should check two issues: external connectivity and sitting of the PC in your work.

1- check the connectivity from work to home. You may enable pinging (ICMP forwarding) in you router or use any other simple services such as apache (port 80). in apache, just add the routing record in your router and try to access it from your work, of course, after testing the apache in your home network. Do you have a firewall at work? Usually, YES. Do the connectivity (tcp ports 139, 445 …etc) to a share folder is allowed? Usually, NO. Is your work connectivity to the internet through proxy or routing? Usually, via proxy. In proxy case, you should check the restriction of the proxy!

2- are you using ms windows active directory in your work? if yes, there are a sitting in the active directory security policy which will prevent some type of connectivity (e.g. file sharing) between the your domain and other domain or even stand alone machine. if your are the admin in your work, i may guide you how to check this sitting.

I highly suggest to try to access your samba from another network rather than your work like internet café. Usually, the PCs there are not part of a domain, there is no firewall, no proxy (routed connection).

Hope that I did not confuse you

. I will check your replay to proceed in solving your problem.
Regards,

nathacof · 04-17-2008, 02:46 PM

Yeah I need to speak with my Network Operations team to see if they can open up those ports to our headquarters from my home IP. I've got an Apache Server running already on my home box everything is fine with that.

But fundamentally you guys are right the problem most likely lies with my work's network ACLs.

Thanks for the input.

bassel · 04-18-2008, 02:45 PM

Anytime, nathacof.

but please, inform me if the problem is solved...

regards