Larry,
I'm not an expert at reading Samba Logs, but when I successfully connect my logs look like this.
xp01 (x.x.x.x) connect to service ghm initially as user tharrison (uid=1002, gid=1001) (pid 31670)
[2006/05/02 04:27:00, 1] smbd/service.c:close_cnum(830)
xp01 (x.x.x.x) closed connection to service ghm
I'm wondering if all those log entries are simply "Windows Noise". Maybe somebody can validate that those log entries look particularly threatening.
However, as others have mentioned, you definitely need to firewall your Samba service. Here's mine. I've removed most of my VPN firewall information but I left the pertinent Samba rules. I've basically got two sets in there, one for OpenVPN and one for Hamachi. The two are slightly different ( I had to relax them a little to get Hamachi working ). I would try the OpenVPN section first. You will need to change the "192.168.99.1/24" to whatever is appropriate for your internal network ( 192.168.1.1/24 (?) ).
If this doesn't work, try modifying it to look more like the Hamachi section.
I'll point out that this firewall denies everything and each connection has to be explicitely allowed. I wouldn't simply through this into place since it'll probably "break" whatever else you have running. It's simply for demonstration.
You might also note that the script is setup as an /etc/init.d/ startup job. You can control it with a /etc/init.d/firewall start|stop|restart|status
*** Assuming you save it as /etc/init.d/firewall of course!
If your box reboots at the same time each day, look at your cron log.
It doesn't appear that your box crashed, but that it was given a shutdown command.
Other users: Please feel free to correct me if I've misspoken on anything here, I won't take offense!
)
Hopes this helps.
Thom
#!/bin/bash
#^^^^^^^^-------------------------------------- Defines the shell. Never use csh!
#
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
# This is the location of the iptables command
IPTABLES="/sbin/iptables"
#---------------------------------------------- Specify any directories needed
PATH='/sbin:/usr/sbin:/bin:/usr/bin'
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
# Your script begins here.
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
case "$1" in
stop)
echo "Stopping Firewall."
# flush all of the iptables rules.
$IPTABLES -F
$IPTABLES -X
$IPTABLES -Z
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP
;;
status)
$IPTABLES -L
;;
restart|reload)
$0 stop
$0 start
;;
start)
echo "Starting Firewall."
################################################################
#Insert modules- should be done automatically if needed
dmesg -n 1 #Kill copyright display on module load
/sbin/modprobe ip_tables
/sbin/modprobe iptable_filter
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
dmesg -n 6
#
## Flush everything, start from scratch
#
# flush all of the iptables rules.
$IPTABLES -F
$IPTABLES -X
$IPTABLES -Z
# originally tcp_syncookies and ip_dynaddr were 1
echo 2 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 > /proc/sys/net/ipv4/tcp_timestamps
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo 1 > /proc/sys/net/ipv4/ip_dynaddr
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians
#---------- Reduce DoS'ing ability by reducing timeouts
echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout
echo 1800 > /proc/sys/net/ipv4/tcp_keepalive_time
echo 0 > /proc/sys/net/ipv4/tcp_window_scaling
echo 0 > /proc/sys/net/ipv4/tcp_sack
#---------- iptables defaults to these if no matches are found below.
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP
##--------- Set basic rules
#----------- Above list ripped from
http://www.linux-mag.com/2000-01/bestdefense_02.html
# --- reject invalid SYN,FIN combinations.
$IPTABLES -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
$IPTABLES -A FORWARD -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
$IPTABLES -A FORWARD -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
$IPTABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
$IPTABLES -A FORWARD -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
# --- allow replies coming in #=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
#Primary Rules Section =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
# Normal Section #
$IPTABLES -A INPUT -p tcp --dport 3022 -j ACCEPT #ssh
$IPTABLES -A INPUT -p udp --dport 3022 -j ACCEPT
# samba - openvpn
$IPTABLES -A INPUT -p udp -m udp -s 192.168.99.1/24 --dport 137 -j ACCEPT
$IPTABLES -A INPUT -p udp -m udp -s 192.168.99.1/24 --dport 138 -j ACCEPT
$IPTABLES -A INPUT -m state --state NEW -m tcp -p tcp -s 192.168.99.1/24 --dport 139 -j ACCEPT
$IPTABLES -A INPUT -m state --state NEW -m tcp -p tcp -s 192.168.99.1/24 --dport 445 -j ACCEPT
# samba - hamachi
$IPTABLES -A INPUT -p udp -m udp -s 5.1.2.3/24 --dport 137 -j ACCEPT
$IPTABLES -A INPUT -p udp -m udp -s 5.1.2.3/24 --dport 138 -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp -s 5.1.2.3/24 --dport 139 -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp -s 5.1.2.3/24 --dport 445 -j ACCEPT
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
*)
echo "Useage: firewall (start|stop|restart)"
exit 1
esac
exit 0
