Howto: Fix Windows share browsing issues

[rjkothari]

Hi,

I'm using Ubuntu 9.10 Desktop 32 bit; and Samba share is created on a Nitix (Lotus Foundations) Server - a proprietary Linux - which has licensed SLES 10 kernel.

Without following any of the steps mentioned by you, I was able to access the Samba shares created on Nitix using Connect to Server under Places. But, I noticed that this shares were not 'persistent' in nature i.e., it would not re-connect when PC was booted. I had to manually do Places->Bookmark->click on each share bookmark to reconnect. But, in trying to solve this auto-reconnect I came across your article.

And, I decided to follow your steps to make it perfect - if it was not. But, in the process, I enabled ufw (which was 'off' earlier). But moment I turned it 'on' - whether I use the 4 rules given by you or not - it is not allowing me to see the Samba shares. I tried even giving the rules other way but still same problem. So, clearly there is something else that needs to be done in ufw setting to make it see the Windows shares on Nitix server.

In the mean time, I am disabling the ufw. Given a choice, I would love to enable ufw.

Can some one revert please?

[ChaoticXSinZ]

A note on the ordering in nsswitch.conf.

By using the one specified in the first post I was able to connect to work group computers by using their netbios name instead of an IP address and regular DNS also worked. But I experienced a delay whenever my system tried to resolve domain names such as google.ca. So I changed my setup to:

hosts:          files dns wins mdns4

Putting wins after dns since I only used WINS resloution for my printer shared through SAMBA. This removed the delay I experienced earlier.

Later on I realized that it was because of the part "[NOTFOUND=return]" which made wins not work when I placed it after dns. So theoretically this should also work:

hosts:          files mdns4_minimal dns wins mdns4

Also one more note: Placing wins after dns won't work if you use a DNS server which redirects you to an error/search page when it can't resolve (i.e. OpenDNS)

[dmizer]

Later on I realized that it was because of the part "[NOTFOUND=return]" which made wins not work when I placed it after dns. So theoretically this should also work:

hosts:          files mdns4_minimal dns wins mdns4

Netbios name resolution almost never works when wins is placed after dns. It has nothing to do with "[NOTFOUND=return]". You may experience delays in DNS if you put wins before [NOTFOUND=return] however. Otherwise, local name resolution most likely won't work.

If you are getting delays when browsing the web, this means that you have another problem on your network ... usually firewall related.

If you do not have a DHCP network (or if you have a DHCP network with permanent leases based on MAC address), you can remove the winbind daemon, remove wins from /etc/nsswitch.conf and add your printer's name to /etc/hosts like so:

$ cat /etc/hosts
127.0.0.1	localhost
127.0.1.1	tsubame.japan.dmizer.dnsdojo.net
192.168.1.100   samba-server.name

# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts

Alternatively, you could add a local DNS server, and that should solve your problem as well.

Also one more note: Placing wins after dns won't work if you use a DNS server which redirects you to an error/search page when it can't resolve (i.e. OpenDNS)

The reason for this is linked in the howto just after the directions for the /etc/nsswitch conf edit: http://ubuntuforums.org/showpost.php...9&postcount=15

[Silvertones]

I've made some progress but there may be a bug in the FW. Not sure I'll describe.

Comp. A = Ubuntu & connects to the internet via dialup
Comp. B = Windows XP no internet needed
A & B are networked via adhoc wirelessly and can see back and forth perfectly. I can see all shares from either comp.The trouble comes from engaging the GUFW
Engage the FW fron GFUW and I can no longer see shared files back and forth as expected.

It's been determined that I need ports 135,137,138,139,445 Both TCP & UDP
My workgroup in Windows is called BOBO.
If I make simple rules in GFUW allowing the above ports the results are:

I can go from comp.B ( windows) to computer A (Ubuntu) perfectly.I can access the shared folder on the Ubuntu comp.
On comp. A ( Ubuntu) If I click network I see "windows network" click on that I see " BOBO" my work group and "Workgroup" the Ubuntu group.Click on "BOBO" and the screen changes but is blank and says 0 items. I should see Comp. B listed but don't.
So it's getting to a point the FW is not stopping me from seeing the "BOBO" group but won't let me see the Comp. in that group.

[dmizer]

The trouble comes from engaging the GUFW
Engage the FW fron GFUW and I can no longer see shared files back and forth as expected.

If you are on a LAN with a firewalled gateway, there's really no reason for you to be using a software firewall locally unless you're on a huge LAN with hundreds of machines.

The only reason I can see you needing a local software firewall is if the laptop is going to be regularly used on unsecured networks or have unfettered access to the WAN as with a Mobile broadband or dial up internet connection. Then, in those cases, you shouldn't have holes poked in your firewall for SAMBA access.

My recomendation is to simply disable the GUFW unless you have a valid reason for using it. If you have a valid reason for using it, then you probably shouldn't be trying to share files over SAMBA.

Edit:
Updated the howto to reflect this.

[Silvertones]

Yes I am on dial up and I do use ensecured wifi spots for large file downloads so I need the firewall. I've put in the rules that you mention of course substituting my IPs for yours. I'm secure with this.
BUT
I can go from comp.B ( windows) to computer A (Ubuntu) perfectly.I can access the shared folder on the Ubuntu comp.
On comp. A ( Ubuntu) If I click network I see "windows network" click on that I see " BOBO" my work group and "Workgroup" the Ubuntu group.Click on "BOBO" and the screen changes but is blank and says 0 items. I should see Comp. B listed but don't.
So it's getting to a point the FW is not stopping me from seeing the "BOBO" group but won't let me see the Comp. in that group.

[jamesisin]

Yes I am on dial up and I do use ensecured wifi spots for large file downloads so I need the firewall. I've put in the rules that you mention of course substituting my IPs for yours. I'm secure with this.
BUT
I can go from comp.B ( windows) to computer A (Ubuntu) perfectly.I can access the shared folder on the Ubuntu comp.
On comp. A ( Ubuntu) If I click network I see "windows network" click on that I see " BOBO" my work group and "Workgroup" the Ubuntu group.Click on "BOBO" and the screen changes but is blank and says 0 items. I should see Comp. B listed but don't.
So it's getting to a point the FW is not stopping me from seeing the "BOBO" group but won't let me see the Comp. in that group.

I would seek out a method of turning your firewall off when on your network and on when not. (Perhaps someone can point you toward a method for auto-detecting your network to (dis)engage your firewall.)

Your firewall will be greatly weakened by leaving all these ports open and permissions granted. You will be much better off using your firewall, when off-network, to protect these permitted areas.

Which version of Windows is computer B running? Also, does computer B appear with the firewall disabled?

[Silvertones]

Thanks Jamesisn,
With the FW disengaged everything is PERFECT in both directions.
Yours is the most practical solution. I can adjust my work habits to only access the LAN when not on line.

[dmizer]

Thanks Jamesisn,
With the FW disengaged everything is PERFECT in both directions.
Yours is the most practical solution. I can adjust my work habits to only access the LAN when not on line.

You could set UFW to allow anything from a particular IP address, namely your Comp. B IP address.

Something like this may do it:

sudo ufw allow from comp.b.ip.address

Try it and see if it works.

[Silvertones]

That's what I'm trying to explain. That's the first thing I did per you instructions on page 1. Like this of course substituting my own IP address range:

sudo ufw allow proto udp to any port 137 from 192.168.1.0/24
sudo ufw allow proto udp to any port 138 from 192.168.1.0/24
sudo ufw allow proto tcp to any port 139 from 192.168.1.0/24
sudo ufw allow proto tcp to any port 445 from 192.168.1.0/24
Now when I press NETWORK instead of seeing nothing I get to the point were I can see the two group folders but no further.
1. BOBO
2. Workgroup

The code above that you mention in the last post is not clear to me. Lets say that comp B name is norton and the IP is 182.168.1.6 would I enter:

sudo ufw allow from comp.norton.ip.182.168.1.6