Linux

Ask something
Discussion Locked

Samba thru ipchains

0 helpful
4 replies

by rouse

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Samba thru ipchains
I am trying to get to my linux server from my windows machine, but am being blocked by my ipchains:
-A input -s 0/0 -d 0/0 25 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 22 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 27015 -p tcp -y -j ACCEPT
-A input -s 0/0 67:68 -d 0/0 67:68 -p udp -i eth0 -j ACCEPT
-A input -s 0/0 67:68 -d 0/0 67:68 -p udp -i eth1 -j ACCEPT
-A input -s 0/0 -d 0/0 -i lo -j ACCEPT
-A input -s 0/0 -d 0/0 110 -p tcp -y -j ACCEPT
-A input -s 192.168.1.0/255.255.255.0 -d 0/0 80 -p tcp -y -j ACCEPT
-A input -p tcp -s 0/0 -d 0/0 0:1023 -y -j REJECT
-A input -p tcp -s 0/0 -d 0/0 2049 -y -j REJECT
-A input -p udp -s 0/0 -d 0/0 0:1023 -j REJECT
-A input -p udp -s 0/0 -d 0/0 2049 -j REJECT
-A input -p tcp -s 0/0 -d 0/0 6000:6009 -y -j REJECT
-A input -p tcp -s 0/0 -d 0/0 7100 -y -j REJECT

I've tried adding accepts to ports 137, 138 & 139, but no go. Can't find the port smbd is listening on. If I flush ipchains, then I can access my linux. Any ideas?
Thanks

4 replies

by marroyo

I am presuming that you are trying to "harden" the OS that Samba is running on ... (I am further presuming that you are using Samba on this linux box).

If you are not, and this linux box functions as your firewall as well, I would suggest that you consider separating the Samba service (put it in a separate box), from your firewall. A firewall, to function properly, should have only the services and packages that are necessary to support its function. Loading multiple applications on the firewall will open up considerable points of attack.

Having said that, I recommend looking for the Bastille project (http://www.bastille-linux.org/). Bastille provides a set of scripts that will "harden" the OS against attack. It supports both ipchains and iptables.

By the way, Samba (CIFS) uses TCP port 139 and UDP ports 135:139.

Good luck!

by rouse

Thanks & I got a good tip on Bastille. OK so where did you find the udp on ports 135 &136? I checked the samba.org page and didn't see that. I'm going to give you the points, but I'd like to hear on that.
For the others with Likewise question, I added:
-A input -s 192.168.1.0/255.255.255.0 -d 0/0 139 -p tcp -y -j ACCEPT
-A input -s 192.168.1.0/255.255.255.0 -d 0/0 135 -p udp -i eth0 -j ACCEPT
-A input -s 192.168.1.0/255.255.255.0 -d 0/0 136 -p udp -i eth0 -j ACCEPT
-A input -s 192.168.1.0/255.255.255.0 -d 0/0 137 -p udp -i eth0 -j ACCEPT
-A input -s 192.168.1.0/255.255.255.0 -d 0/0 138 -p udp -i eth0 -j ACCEPT
-A input -s 192.168.1.0/255.255.255.0 -d 0/0 139 -p udp -i eth0 -j ACCEPT

.. since I only have one nic.

This discussion is closed to new replies.