Re: [SOLVED] samba and ufw
Quote:
Originally Posted by
kamaji792
I have been trying to set up an ubuntu box (8.04) to provide some network storage for some windows PCs. I am using
ufw as a firewall and
samba as the file server. There is a router allowing the windows PCs to access the internet, so the idea of the firewall is to stop anyone connecting from outside the local network. The default for ufw is to deny.
The only way I can get it to work is with ufm set up as shown by the status:
Code:
$ ufw status
Firewall loaded
To Action From
-- ------ ----
Anywhere ALLOW 192.168.0.0/24
I know samba is supposed to use ports 135, 137, 138, 139 and 445.
However if I only open these ports (tcp and udp) I can't connect from the windows PCs. Interestingly I can't see any logging of dropped packets in the syslog (yes, logging is turned on).
I have seen one comment that said you need ports 1024 to 65535 to be open as well. However ufw does not allow you to specify a rage of ports so opening large number of ports is impractical.
Is this the best I can do or do ? :confused:
or do I need to learn IP tables :cry:
Thanks in advance
Using ufw, here is mine....it works great.
sudo ufw allow proto udp from 192.168.1.0/24 to any port 137
sudo ufw allow proto udp from 192.168.1.0/24 to any port 138
sudo ufw allow proto tcp from 192.168.1.0/24 to any port 139
sudo ufw allow proto tcp from 192.168.1.0/24 to any port 445
Re: [SOLVED] samba and ufw
For ubuntu 8.04 and 8.10
Taken from ...
http://log.logfish.net/node/31
OR
http://www.mypcsupport.de/net/linux/ubuntu-ufw/
1/
You might also want to change /etc/default/ufw and add add the netbios_ns line so you can use samba:
Code:
# The nf_contrack_netbios_ns has been added
IPT_MODULES="nf_conntrack_ftp nf_nat_ftp nf_conntrack_irc nf_nat_irc nf_conntrack_netbios_ns"
2/
#Samba sharing [1]
Code:
sudo ufw allow proto tcp to any port 135 from 192.168.0.0/16
sudo ufw allow proto udp to any port 137 from 192.168.0.0/16
sudo ufw allow proto udp to any port 138 from 192.168.0.0/16
sudo ufw allow proto tcp to any port 139 from 192.168.0.0/16
sudo ufw allow proto tcp to any port 445 from 192.168.0.0/16
3/
#Allow avahi/bonjour/zeroconf [2]
Code:
sudo ufw allow proto udp to any port 5353 from 192.168.0.0/16
Additionally install:
samba-tools
system-config-samba
Access system-config-samba via System -> Administration -> Samba and do all you configuration there.
Re: [SOLVED] samba and ufw
It's really simple. Just issue
Code:
sudo ufw allow Samba
This configures it for all samba ports via the app facility in ufw... man ufw for more details. This was with Ubuntu 10.4.
Re: [SOLVED] samba and ufw
mfrederickson67, That's very interesting.
So if I wanted to replicate the same samba settings that sefs did then the syntax would be this:
Code:
sudo ufw allow from 192.168.0.0/16 to any app Samba
Is that how you understand the syntax?
Re: [SOLVED] samba and ufw
The right rule is this: :popcorn:
Code:
sudo ufw allow from any app Samba to "yourlinuxboxIP"
Re: [SOLVED] samba and ufw
Me thinks this is back to front (or un-documented alternative syntax)...
Quote:
Originally Posted by
k23
The right rule is this: :popcorn:
Code:
sudo ufw allow from any app Samba to "yourlinuxboxIP"
From the man page...
Quote:
Users can specify one of the applications names when adding rules. For
example, when using the simple syntax, users can use:
ufw allow <name>
Or for the extended syntax:
ufw allow from 192.168.0.0/16 to any app <name>
You should not specify the protocol with either syntax, and with the
extended syntax, use app in place of the port clause.
This worked for me
Code:
sudo ufw allow from 192.168.1.0/24 to any app samba
sudo ufw allow from 192.168.1.0/24 to any app cups
So just to check...
Code:
sudo ufw status verbose
Status: active
Logging: off
Default: deny (incoming), allow (outgoing)
New profiles: skip
To Action From
-- ------ ----
137,138/udp (Samba) ALLOW IN 192.168.1.0/24
139,445/tcp (Samba) ALLOW IN 192.168.1.0/24
631 (CUPS) ALLOW IN 192.168.1.0/24
I'd be interested in any other comments as I have found UFW to be a little quirky, especially...
Re: the logging (rather the lack of it) mentioned by kamaji792 in the original post.
I have found a couple of errors in the man page.
log-all, mentioned briefly in the man page, does nothing
Syntax for setting log level seems not to work, except for default level of low
Code:
sudo ufw logging off
Again just checking
Code:
sudo ufw status verbose
Status: active
Logging: off
....
Try to turn on logging and set log level in one command
Code:
sudo ufw logging on high
Checking
Code:
sudo ufw status verbose
Status: active
Logging: on (low)
I found I could only set the log level to higher than low with 2 commands.
First turn logging on
Code:
sudo ufw logging on
Then set a higher level
Code:
sudo ufw logging medium
While I'm here I might mention the other inconsistency I came across in the use of the pre-defined application rules for SAMBA.
The SAMBA manual clearly states these ports are used by SAMBA (smbd & nmbd) as referenced by kamaji792 in this post Firewall & ports
Quote:
Port 135/TCP - used by smbd
Port 137/UDP - used by nmbd
Port 138/UDP - used by nmbd
Port 139/TCP - used by smbd
Port 445/TCP - used by smbd
Yet the Samba application rule omits port 135, which BTW is Microsoft Remote Procedure Call (RPC) service.
Code:
sudo ufw app info Samba
Profile: Samba
Title: LanManager-like file and printer server for Unix
Description: The Samba software suite is a collection of programs that
implements the SMB/CIFS protocol for unix systems, allowing you to serve
files and printers to Windows, NT, OS/2 and DOS clients. This protocol is
sometimes also referred to as the LanManager or NetBIOS protocol.
Ports:
137,138/udp
139,445/tcp
More info from Gibson Research Corporation
Quote:
Name: dcom-scm
Purpose: DCOM Service Control Manager
Description: Microsoft's DCOM (Distributed, i.e. networked, COM) Service Control Manager (also known as the RPC Endpoint Mapper) uses this port in a manner similar to SUN's UNIX use of port 111. The SCM server running on the user's computer opens port 135 and listens for incoming requests from clients wishing to locate the ports where DCOM services can be found on that machine.
Re: [SOLVED] samba and ufw
Quote:
Originally Posted by
tebbens
Using ufw, here is mine....it works great.
sudo ufw allow proto udp from 192.168.1.0/24 to any port 137
sudo ufw allow proto udp from 192.168.1.0/24 to any port 138
sudo ufw allow proto tcp from 192.168.1.0/24 to any port 139
sudo ufw allow proto tcp from 192.168.1.0/24 to any port 445
i like this one :D