LinuxQuestions.org
Visit Jeremy's Blog.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 11-21-2002, 04:08 PM   #1
MaleMe
LQ Newbie
 
Registered: Jun 2002
Location: Texas
Distribution: RedHat
Posts: 7

Rep: Reputation: 0
Unhappy Samba and IPChains


I currently have RedHat 7.2 networked with one Win2k client through Samba. On the Win2k client I am able to see and access
Linux shares through Network Neighborhood. When the following IPChains file is used I am no longer able to access my LAN (pai) through Network Neighborhood on the Win2k client. If I remove the second to the last line in IPChains file it will work, but that is not the real fix!

<IPChains File>
:input ACCEPT
:forward ACCEPT
utput ACCEPT
# Loopback 127.0.0.1
-A input -s 0/0 -d 0/0 -i lo -j ACCEPT
-A input -s 0/0 -d 0/0 80 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 21 -p tcp -y -j ACCEPT
-A input -s 0/0 67:68 -d 0/0 67:68 -p udp -i eth0 -j ACCEPT
-A input -p udp -s 0/0 -d 0/0 0:1023 -j ACCEPT
# MySQL Port 3306
-A input -s 0/0 -d 0/0 3306 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 3306 -p udp -j ACCEPT
# Deny telnet port 23 access
-A input -p tcp --dport 23 -j DENY
# Deny "pinging" on this machine
-A input -p icmp -j DENY
# Deny tcp/udp not previously defined
-A input -s 0/0 -d 0/0 -p tcp -y -j DENY (remove-will work)
-A input -s 0/0 -d 0/0 -p udp -j DENY

Both machines have static IPs and the IP/hostnames are resolved using /etc/hosts as follows:

192.168.5.5 daytona (Linux box)
192.168.5.3 dylan (Win2k client)
127.0.0.1 daytona.pai

I believe I need to allow input on port 53 (DNS) to resolve this issue with Samba, but not sure exactly how.
Any help would be appreciated...... I've been scratching my head
a day or 2 on this one.
 
Old 11-21-2002, 04:20 PM   #2
peter_robb
Senior Member
 
Registered: Feb 2002
Location: Szczecin, Poland
Distribution: Gentoo, Debian
Posts: 2,458

Rep: Reputation: 48
You need to allow udp traffic on ports 137,138,139 for Network Neighbourhood to work,
The ipchains tutorial is here http://tldp.org/HOWTO/IPCHAINS-HOWTO.html
 
Old 11-24-2002, 08:36 PM   #3
MaleMe
LQ Newbie
 
Registered: Jun 2002
Location: Texas
Distribution: RedHat
Posts: 7

Original Poster
Rep: Reputation: 0
To get Network Neighborhood fully functional I had to allow udp and tcp traffic on the NetBIOS ports you mentioned. Works great now thanks for the help!
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
ipchains log and samba query RichardBuck Linux - Networking 0 12-22-2004 07:16 PM
Samba and IPCHAINS puzz_1 Linux - Security 1 11-17-2003 08:26 AM
ipchains and samba Serena Linux - Networking 1 04-27-2002 10:20 AM
ipchains mika9372 Linux - Newbie 6 03-29-2002 12:03 PM
IpChains again ETT Linux - Security 3 07-24-2001 07:49 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 06:31 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration