[CentOS] Security help desperately needed - more info

Thu Feb 7 15:14:28 UTC 2008
Ross S. W. Walker <rwalker at medallion.com>

Michael Simpson wrote:
> On 2/7/08, Anne Wilson <cannewilson at googlemail.com> wrote:
> > On Thursday 07 February 2008 13:53, Milton Calnek wrote:
> > > Anne Wilson wrote:
> > > >  --------------------- samba Begin ------------------------
> > > >
> > > >
> > > >  WARNING!!!!!!
> > > >  Errors when creating subnets:
> > > >     No subnets to listen to. Shutting down. : 1 Time(s)
> > >
> > > Hmmm... let's see your smb.conf.
> > >
> > [global]
> >        workgroup = LYDGATE.LAN
> >        server string = Samba Server Version %v
> >        interfaces = lo, eth0, 192.168.0.0/24
> 
> Hi there,
> 
> Should the IP address supplied be the actual address for eth0 rather
> than the network address?
> 
> ie 192.168.0.1/24 rather than 192.168.0.0/24

If if doubt RTFM:

interfaces (G)
   This option allows you to override the  default  network  interfaces
   list  that  Samba will use for browsing, name registration and other
   NBT traffic. By default Samba will query the kernel for the list  of
   all  active  interfaces and use any interfaces except 127.0.0.1 that
   are broadcast capable.
<More in the man page>

Per the man page the interfaces directive seems to only control which
interfaces smb will listen for and respond to name requests.

If you wanted smb to bind to only those interfaces you will need to
combine it with:

bind interfaces only (G)
   This  global  parameter  allows the Samba admin to limit what inter-
   faces on a machine will serve SMB requests. It affects file  service
   smbd(8) and name service nmbd(8) in a slightly different ways.

   For  name service it causes nmbd to bind to ports 137 and 138 on the
   interfaces listed in the interfaces parameter.  nmbd also  binds  to
   the "all addresses" interface (0.0.0.0) on ports 137 and 138 for the
   purposes of reading broadcast messages. If this option  is  not  set
   then  nmbd  will  service  name requests on all of these sockets. If
   bind interfaces only is set then nmbd will check the source  address
   of  any  packets  coming in on the broadcast sockets and discard any
   that don't match the broadcast addresses of the  interfaces  in  the
   interfaces  parameter  list.  As unicast packets are received on the
   other sockets it allows nmbd to refuse to serve  names  to  machines
   that  send  packets that arrive through any interfaces not listed in
   the interfaces list. IP Source address  spoofing  does  defeat  this
   simple  check,  however, so it must not be used seriously as a secu-
   rity feature for nmbd.

   For file service it causes smbd(8) to bind  only  to  the  interface
   list  given in the interfaces parameter. This restricts the networks
   that smbd will serve to packets coming  in  those  interfaces.  Note
   that you should not use this parameter for machines that are serving
   PPP or other intermittent or non-broadcast network interfaces as  it
   will not cope with non-permanent interfaces.

   If  bind  interfaces  only  is  set  then unless the network address
   127.0.0.1 is added to the interfaces parameter list smbpasswd(8) and
   swat(8) may not work as expected due to the reasons covered below.

   To change a users SMB password, the smbpasswd by default connects to
   the localhost - 127.0.0.1 address as an  SMB  client  to  issue  the
   password  change request. If bind interfaces only is set then unless
   the network address 127.0.0.1 is added to the  interfaces  parameter
   list then smbpasswd will fail to connect in it's default mode.  smb-
   passwd can be forced to use the primary IP interface  of  the  local
   host  by  using  its  smbpasswd(8) -r remote machine parameter, with
   remote machine set to the IP name of the primary  interface  of  the
   local host.

   The  swat  status  page  tries  to connect with smbd and nmbd at the
   address 127.0.0.1 to determine  if  they  are  running.  Not  adding
   127.0.0.1 will cause smbd and nmbd to always show "not running" even
   if they really  are.  This  can  prevent  swat  from  starting/stop-
   ping/restarting smbd and nmbd.

   Default: bind interfaces only = no


I would look at the DNS setup to make sure all host names are resolvable,
maybe the /etc/hosts file isn't setup properly. Make sure smb ports are
open inbound and outbound in iptables and the latest selinux profile is
installed.

-Ross

______________________________________________________________________
This e-mail, and any attachments thereto, is intended only for use by
the addressee(s) named herein and may contain legally privileged
and/or confidential information. If you are not the intended recipient
of this e-mail, you are hereby notified that any dissemination,
distribution or copying of this e-mail, and any attachments thereto,
is strictly prohibited. If you have received this e-mail in error,
please immediately notify the sender and permanently delete the
original and any copy or printout thereof.