peter grotz schrieb:

Hallo Ihr beiden,

Bernhard Lindenau schrieb:

...

daniel kuesgen schrieb:

...

Ich habe lediglich unter /etc/sysconfig eine Konfigurationsdatei SuSEfirewall2 gefunden, die aber ein altes Datum hatte. Dort habe ich in Zeile 341 den Parameter FW_SERVICE_SAMBA="yes" gesetzt und dann Firewall und den ganzen Server neu gestartet.

Hi Daniel,

bei mir reichte das nicht, erst als ich den Port 139 explizit freigeschaltet hatte funktionierte es (Abschnitt 9: FW_SERVICES_INT_TCP="139" - wenn dort schon etwas eingetragen ist, Nummern mit Leerzeichen trennen: "53 80 139 1024"). FW_DEV_INT="[Interface zum internen Netzwerk, bei mir z.B. eth1]" im 3. Abschnitt hast Du sicher schon gesetzt.

schaltet auch den port 137 auch frei! und vor allem tcp _und_ udp !!

Tatsächlich habe ich nur den 139 in FW_SERVICES_INT_TCP freigeschaltet und es funzte - vielleicht schaltet FW_SERVICE_SAMBA="yes" den 137 in beiden Protokollen frei (was doch eigentlich auch so sein sollte - und die Frage aufwirft, warum das mit 139 nicht klappt). gruß, bl

Hallo Trio, vielen Dannk für die gesammelten Anregungen, Michael Meyer schrieb:

Bernhard Lindenau wrote:

...

peter grotz schrieb:

...

schaltet auch den port 137 auch frei! und vor allem tcp _und_ udp !!

Tatsächlich habe ich nur den 139 in FW_SERVICES_INT_TCP freigeschaltet und es funzte - vielleicht schaltet FW_SERVICE_SAMBA="yes" den 137 in beiden Protokollen frei (was doch eigentlich auch so sein sollte - und die Frage aufwirft, warum das mit 139 nicht klappt).

sagt mal, schaut eigentlich niemand von euch mal in '/etc/sysconfig/SuSEfirewall2' rein? ihr benutzt es doch.

*kopfschüttel*

,----[ /tmp/SF2/firewall2.rc.config.EXAMPLE ] | FW_SERVICE_SAMBA="no" | | set to "yes" if this server uses samba as client or server. As a | server, you still have to set FW_SERVICES_{EXT,DMZ,INT}_TCP="139". | Everyone may send you udp 137/138 packets if set to yes! (samba on | the firewall is not a good idea!) `----|

micha

Inzwischen gibt es neues und leider doch nichts neues vom Ursprung des Diskurses. Zwischenzeitich habe ich unter FW_SERVICE_INT_TCP und FW_SERVICE_INT_UDP jeweils "137 138 139" freigegeben, neu gestartet und bin leider genauso weit wie vorher...rien ne va plus auf dem Win-Client. Verwunderlich+erschreckend ist auch, dass die SMB-Shares selbst dann nicht mehr zugänglich sind, wenn ich die Firewall mit 'rcSuSEfirewall stop' herunterfahre. Ich hänge mal die SuSEFirewall2 und messages hoffnungsvoll mit an - sehe wohl vor Bäumen den Wald nicht mehr... Gruß, Daniel /etc/sysconfig/SuSEfirewall2: ============================= # Copyright (c) 2001 SuSE GmbH Nuernberg, Germany. All rights reserved. # # Author: Marc Heuse , 2001 # Please contact me directly if you find bugs. # # If you have problems getting this tool configures, please read this file # carefuly and take also a look into # -> /usr/share/doc/packages/SuSEfirewall2/EXAMPLES ! # -> /usr/share/doc/packages/SuSEfirewall2/FAQ ! # -> /usr/share/doc/packages/SuSEfirewall2/SuSEfirewall2.conf.EXAMPLE ! # # /etc/sysconfig/SuSEfirewall2 # # for use with /sbin/SuSEfirewall2 version 2.1 which is for 2.4 kernels! # # ------------------------------------------------------------------------ # # PLEASE NOTE THE FOLLOWING: # # Just by configuring these settings and using the SuSEfirewall2 you are # not secure per se! There is *not* such a thing you install and hence you # are safed from all (security) hazards. # # To ensure your security, you need also: # # * Secure all services you are offering to untrusted networks (internet) # You can do this by using software which has been designed with # security in mind (like postfix, apop3d, ssh), setting these up without # misconfiguration and praying, that they have got really no holes. # SuSEcompartment can help in most circumstances to reduce the risk. # * Do not run untrusted software. (philosophical question, can you trust # SuSE or any other software distributor?) # * Harden your server(s) with the harden_suse package/script # * Recompile your kernel with the openwall-linux kernel patch # (former secure-linux patch, from Solar Designer) www.openwall.com # * Check the security of your server(s) regulary # * If you are using this server as a firewall/bastion host to the internet # for an internal network, try to run proxy services for everything and # disable routing on this machine. # * If you run DNS on the firewall: disable untrusted zone transfers and # either don't allow access to it from the internet or run it split-brained. # # Good luck! # # Yours, # SuSE Security Team # # ------------------------------------------------------------------------ # # Configuration HELP: # # If you have got any problems configuring this file, take a look at # /usr/share/doc/packages/SuSEfirewall2/EXAMPLES for an example. # # # All types have to set enable SuSEfirewall2 in the runlevel editor # # If you are a end-user who is NOT connected to two networks (read: you have # got a single user system and are using a dialup to the internet) you just # have to configure (all other settings are OK): 2) and maybe 9). # # If this server is a firewall, which should act like a proxy (no direct # routing between both networks), or you are an end-user connected to the # internet and to an internal network, you have to setup your proxys and # reconfigure (all other settings are OK): 2), 3), 9) and maybe 7), 11), 14) # # If this server is a firewall, and should do routing/masquerading between # the untrusted and the trusted network, you have to reconfigure (all other # settings are OK): 2), 3), 5), 6), 9), and maybe 7), 10), 11), 12), 13), # 14), 20) # # If you want to run a DMZ in either of the above three standard setups, you # just have to configure *additionally* 4), 9), 12), 13), 17), 19). # # If you know what you are doing, you may also change 8), 11), 15), 16) # and the expert options 19), 20), 21), 22) and 23) at the far end, but you # should NOT. # # If you use diald or ISDN autodialing, you might want to set 17). # # To get programs like traceroutes to your firewall to work is a bit tricky, # you have to set the following options to "yes" : 11 (UDP only), 18 and 19. # # Please note that if you use service names, that they exist in /etc/services. # There is no service "dns", it's called "domain"; email is called "smtp" etc. # # *Any* routing between interfaces except masquerading requires to set FW_ROUTE # to "yes" and use FW_FORWARD or FW_ALLOW_CLASS_ROUTING ! # # If you just want to do masquerading without filtering, ignore this script # and run this line (exchange "ippp0" "ppp0" if you use a modem, not isdn): # iptables -A POSTROUTING -t nat -j MASQUERADE -o ippp0 # echo 1 > /proc/sys/net/ipv4/ip_forward # and additionally the following lines to get at least a minimum of security: # iptables -A INPUT -j DROP -m state --state NEW,INVALID -i ippp0 # iptables -A FORWARD -j DROP -m state --state NEW,INVALID -i ippp0 # ------------------------------------------------------------------------ # # 1.) # Should the Firewall be started? # # This setting is done via the links in the /etc/init.d/rc?.d runlevel # directories, which can be tweaked with a runlevel editor (or manually) # # 2.) # Which is the interface that points to the internet/untrusted networks? # # Enter all the network devices here which are untrusted. # # Choice: any number of devices, seperated by a space # e.g. "eth0", "ippp0 ippp1 eth0:1" # FW_DEV_EXT="ippp0" # # 3.) # Which is the interface that points to the internal network? # # Enter all the network devices here which are trusted. # If you are not connected to a trusted network (e.g. you have just a # dialup) leave this empty. # # Choice: leave empty or any number of devices, seperated by a space # e.g. "tr0", "eth0 eth1 eth1:1" or "" # FW_DEV_INT="eth0" # # 4.) # Which is the interface that points to the dmz or dialup network? # # Enter all the network devices here which point to the dmz/dialups. # A "dmz" is a special, seperated network, which is only connected to the # firewall, and should be reachable from the internet to provide services, # e.g. WWW, Mail, etc. and hence are at risk from attacks. # See /usr/share/doc/packages/SuSEfirewall2/EXAMPLES for an example. # # Special note: You have to configure FW_FORWARD to define the services # which should be available to the internet and set FW_ROUTE to yes. # # Choice: leave empty or any number of devices, seperated by a space # e.g. "tr0", "eth0 eth1 eth1:1" or "" # FW_DEV_DMZ="" # # 5.) # Should routing between the internet, dmz and internal network be activated? # REQUIRES: FW_DEV_INT or FW_DEV_DMZ # # You need only set this to yes, if you either want to masquerade internal # machines or allow access to the dmz (or internal machines, but this is not # a good idea). This option supersedes IP_FORWARD from # /etc/sysconfig/network/options # # Setting this option one alone doesn't do anything. Either activate # massquerading with FW_MASQUERADE below if you want to masquerade your # internal network to the internet, or configure FW_FORWARD to define # what is allowed to be forwarded! # # Choice: "yes" or "no", defaults to "no" # FW_ROUTE="yes" # # 6.) # Do you want to masquerade internal networks to the outside? # REQUIRES: FW_DEV_INT or FW_DEV_DMZ, FW_ROUTE # # "Masquerading" means that all your internal machines which use services on # the internet seem to come from your firewall. # Please note that it is more secure to communicate via proxies to the # internet than masquerading. This option is required for FW_MASQ_NETS and # FW_FORWARD_MASQ. # # Choice: "yes" or "no", defaults to "no" # FW_MASQUERADE="yes" # # You must also define on which interface(s) to masquerade on. This is # normally your external device(s) to the internet. # Most users can leave the default below. # # e.g. "ippp0" or "$FW_DEV_EXT" FW_MASQ_DEV="$FW_DEV_EXT" # # Which internal computers/networks are allowed to access the internet # directly (not via proxys on the firewall)? # Only these networks will be allowed access and will be masqueraded! # # Choice: leave empty or any number of hosts/networks seperated by a space. # Every host/network may get a list of allowed services, otherwise everything # is allowed. A target network, protocol and service is appended by a comma to # the host/network. e.g. "10.0.0.0/8" allows the whole 10.0.0.0 network with # unrestricted access. "10.0.1.0/24,0/0,tcp,80 10.0.1.0/24,0/0tcp,21" allows # the 10.0.1.0 network to use www/ftp to the internet. # "10.0.1.0/24,tcp,1024:65535 10.0.2.0/24" is OK too. # Set this variable to "0/0" to allow unrestricted access to the internet. # FW_MASQ_NETS="0/0" # # 7.) # Do you want to protect the firewall from the internal network? # REQUIRES: FW_DEV_INT # # If you set this to "yes", internal machines may only access services on # the machine you explicitly allow. They will be also affected from the # FW_AUTOPROTECT_SERVICES option. # If you set this to "no", any user can connect (and attack) any service on # the firewall. # # Choice: "yes" or "no", defaults to "yes" # # "yes" is a good choice FW_PROTECT_FROM_INTERNAL="no" # # 8.) # Do you want to autoprotect all running network services on the firewall? # # If set to "yes", all network access to services TCP and UDP on this machine # will be prevented (except to those which you explicitly allow, see below: # FW_SERVICES_{EXT,DMZ,INT}_{TCP,UDP}) # # Choice: "yes" or "no", defaults to "yes" # FW_AUTOPROTECT_SERVICES="yes" # # 9.) # Which services ON THE FIREWALL should be accessible from either the internet # (or other untrusted networks), the dmz or internal (trusted networks)? # (see no.13 & 14 if you want to route traffic through the firewall) XXX # # Enter all ports or known portnames below, seperated by a space. # TCP services (e.g. SMTP, WWW) must be set in FW_SERVICES_*_TCP, and # UDP services (e.g. syslog) must be set in FW_SERVICES_*_UDP. # e.g. if a webserver on the firewall should be accessible from the internet: # FW_SERVICES_EXT_TCP="www" # e.g. if the firewall should receive syslog messages from the dmz: # FW_SERVICES_DMZ_UDP="syslog" # For IP protocols (like GRE for PPTP, or OSPF for routing) you need to set # FW_SERVICES_*_IP with the protocol name or number (see /etc/protocols) # # Choice: leave empty or any number of ports, known portnames (from # /etc/services) and port ranges seperated by a space. Port ranges are # written like this: allow port 1 to 10 -> "1:10" # e.g. "", "smtp", "123 514", "3200:3299", "ftp 22 telnet 512:514" # For FW_SERVICES_*_IP enter the protocol name (like "igmp") or number ("2") # # Common: smtp domain FW_SERVICES_EXT_TCP="http https imap imaps pop3 pop3s smtp ssh" # Common: domain FW_SERVICES_EXT_UDP="" # Common: domain # For VPN/Routing which END at the firewall!! FW_SERVICES_EXT_IP="" # # Common: smtp domain FW_SERVICES_DMZ_TCP="" # Common: domain FW_SERVICES_DMZ_UDP="" # For VPN/Routing which END at the firewall!! FW_SERVICES_DMZ_IP="" # # Common: ssh smtp domain FW_SERVICES_INT_TCP="137 138 139" # Eintrag vorgenommen 12.06.30 # Common: domain syslog FW_SERVICES_INT_UDP="137 138 139" # Eingefügt 12.06.03 # For VPN/Routing which END at the firewall!! FW_SERVICES_INT_IP="" # # 10.) # Which services should be accessible from trusted hosts/nets? # # Define trusted hosts/networks (doesnt matter if they are internal or # external) and the TCP and/or UDP services they are allowed to use. # Please note that a trusted host/net is *not* allowed to ping the firewall # until you set it to allow also icmp! # # Choice: leave FW_TRUSTED_NETS empty or any number of computers and/or # networks, seperated by a space. e.g. "172.20.1.1 172.20.0.0/16" # Optional, enter a protocol after a comma, e.g. "1.1.1.1,icmp" # Optional, enter a port after a protocol, e.g. "2.2.2.2,tcp,22" # FW_TRUSTED_NETS="" # # 11.) # How is access allowed to high (unpriviliged [above 1023]) ports? # # You may either allow everyone from anyport access to your highports ("yes"), # disallow anyone ("no"), anyone who comes from a defined port (portnumber or # known portname) [note that this is easy to circumvent!], or just your # defined nameservers ("DNS"). # Note that you can't use rpc requests (e.g. rpcinfo, showmount) as root # from a firewall using this script (well, you can if you include range # 600:1023 in FW_SERVICES_EXT_UDP ...). # Please note that with v2.1 "yes" is not mandatory for active FTP from # the firewall anymore. # # Choice: "yes", "no", "DNS", portnumber or known portname, defaults to "no" # if not set # # Common: "ftp-data", better is "yes" to be sure that everything else works :-( FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" # Common: "DNS" or "domain ntp", better is "yes" to be sure ... FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" # # 12.) # Are you running some of the services below? # They need special attention - otherwise they wonŽt work! # # Set services you are running to "yes", all others to "no", defaults to "no" # if not set. # FW_SERVICE_AUTODETECT="yes" # Autodetect the services below when starting # # If you are running bind/named set to yes. Remember that you have to open # port 53 (or "domain") as udp/tcp to allow incoming queries. # Also FW_ALLOW_INCOMING_HIGHPORTS_UDP needs to be "yes" FW_SERVICE_DNS="no" # # if you use dhclient to get an ip address you have to set this to "yes" ! FW_SERVICE_DHCLIENT="no" # # set to "yes" if this server is a DHCP server FW_SERVICE_DHCPD="no" # # set to "yes" if this server is running squid. You still have to open the # tcp port 3128 to allow remote access to the squid proxy service. FW_SERVICE_SQUID="no" # # set to "yes" if this server is running a samba server. You still have to open # the tcp port 139 to allow remote access to SAMBA. FW_SERVICE_SAMBA="yes" # Variable auf 'yes' gesetzt am 10.06.03 # # 13.) # Which services accessed from the internet should be allowed to the # dmz (or internal network - if it is not masqueraded)? # REQUIRES: FW_ROUTE # # With this option you may allow access to e.g. your mailserver. The # machines must have valid, non-private, IP addresses which were assigned to # you by your ISP. This opens a direct link to your network, so only use # this option for access to your dmz!!!! # # Choice: leave empty (good choice!) or use the following explained syntax # of forwarding rules, seperated each by a space. # A forwarding rule consists of 1) source IP/net and 2) destination IP # seperated by a comma. e.g. "1.1.1.1,2.2.2.2 3.3.3.3/16,4.4.4.4/24" # Optional is a protocol, seperated by a comma, e.g. "5.5.5.5,6.6.6.6,igmp" # Optional is a port after the protocol with a comma, e.g. "0/0,0/0,udp,514" # FW_FORWARD="" # Beware to use this! # # 14.) # Which services accessed from the internet should be allowed to masqueraded # servers (on the internal network or dmz)? # REQUIRES: FW_ROUTE # # With this option you may allow access to e.g. your mailserver. The # machines must be in a masqueraded segment and may not have public IP addesses! # Hint: if FW_DEV_MASQ is set to the external interface you have to set # FW_FORWARD from internal to DMZ for the service as well to allow access # from internal! # # Please note that this should *not* be used for security reasons! You are # opening a hole to your precious internal network. If e.g. the webserver there # is compromised - your full internal network is compromised!! # # Choice: leave empty (good choice!) or use the following explained syntax # of forward masquerade rules, seperated each by a space. # A forward masquerade rule consists of 1) source IP/net, 2) destination IP # (dmz/intern), 3) a protocol (tcp/udp only!) and 4) destination port, # seperated by a comma (","), e.g. "4.0.0.0/8,1.1.1.1,tcp,80" # Optional is a port after the destination port, to redirect the request to # a different destination port on the destination IP, e.g. # "4.0.0.0/8,1.1.1.1,tcp,80,81" # FW_FORWARD_MASQ="" # Beware to use this! # # 15.) # Which accesses to services should be redirected to a localport on the # firewall machine? # # This can be used to force all internal users to surf via your squid proxy, # or transparently redirect incoming webtraffic to a secure webserver. # # Choice: leave empty or use the following explained syntax of redirecting # rules, seperated by a space. # A redirecting rule consists of 1) source IP/net, 2) destination IP/net, # 3) protocol (tcp or udp) 3) original destination port and 4) local port to # redirect the traffic to, seperated by a colon. e.g.: # "10.0.0.0/8,0/0,tcp,80,3128 0/0,172.20.1.1,tcp,80,8080" # FW_REDIRECT="" # # 16.) # Which logging level should be enforced? # You can define to log packets which were accepted or denied. # You can also the set log level, the critical stuff or everything. # Note that logging *_ALL is only for debugging purpose ... # # Choice: "yes" or "no", FW_LOG_*_CRIT defaults to "yes", # FW_LOG_*_ALL defaults to "no" # FW_LOG_DROP_CRIT="yes" # FW_LOG_DROP_ALL="no" # FW_LOG_ACCEPT_CRIT="yes" # FW_LOG_ACCEPT_ALL="no" # # only change/activate this if you know what you are doing! FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" # # 17.) # Do you want to enable additional kernel TCP/IP security features? # If set to yes, some obscure kernel options are set. # (icmp_ignore_bogus_error_responses, icmp_echoreply_rate, # icmp_destunreach_rate, icmp_paramprob_rate, icmp_timeexeed_rate, # ip_local_port_range, log_martians, mc_forwarding, mc_forwarding, # rp_filter, routing flush) # Tip: Set this to "no" until you have verified that you have got a # configuration which works for you. Then set this to "yes" and keep it # if everything still works. (It should!) ;-) # # Choice: "yes" or "no", defaults to "yes" # FW_KERNEL_SECURITY="yes" # # 18.) # Keep the routing set on, if the firewall rules are unloaded? # REQUIRES: FW_ROUTE # # If you are using diald, or automatic dialing via ISDN, if packets need # to be sent to the internet, you need to turn this on. The script will then # not turn off routing and masquerading when stopped. # You *might* also need this if you have got a DMZ. # Please note that this is *insecure*! If you unload the rules, but are still # connected, you might your internal network open to attacks! # The better solution is to remove "/sbin/SuSEfirewall2 stop" or # "/sbin/init.d/firewall stop" from the ip-down script! # # # Choices "yes" or "no", defaults to "no" # FW_STOP_KEEP_ROUTING_STATE="no" # # 19.) # Allow (or don't) ICMP echo pings on either the firewall or the dmz from # the internet? The internet option is for allowing the DMZ and the internal # network to ping the internet. # REQUIRES: FW_ROUTE for FW_ALLOW_PING_DMZ and FW_ALLOW_PING_EXT # # Choice: "yes" or "no", defaults to "no" if not set # FW_ALLOW_PING_FW="yes" # FW_ALLOW_PING_DMZ="no" # FW_ALLOW_PING_EXT="no" ## # END of rc.firewall ## # # #-------------------------------------------------------------------------# # # # EXPERT OPTIONS - all others please don't change these! # # # #-------------------------------------------------------------------------# # # # # 20.) # Allow (or don't) ICMP time-to-live-exceeded to be send from your firewall. # This is used for traceroutes to your firewall (or traceroute like tools). # # Please note that the unix traceroute only works if you say "yes" to # FW_ALLOW_INCOMING_HIGHPORTS_UDP, and windows traceroutes only if you say # additionally "yes" to FW_ALLOW_PING_FW # # Choice: "yes" or "no", defaults to "no" if not set. # FW_ALLOW_FW_TRACEROUTE="yes" # # 21.) # Allow ICMP sourcequench from your ISP? # # If set to yes, the firewall will notice when connection is choking, however # this opens yourself to a denial of service attack. Choose your poison. # # Choice: "yes" or "no", defaults to "yes" # FW_ALLOW_FW_SOURCEQUENCH="yes" # # 22.) # Allow/Ignore IP Broadcasts? # # If set to yes, the firewall will not filter broadcasts by default. # This is needed e.g. for Netbios/Samba, RIP, OSPF where the broadcast # option is used. # If you do not want to allow them however ignore the annoying log entries, # set FW_IGNORE_FW_BROADCAST to yes. # # Choice: "yes" or "no", defaults to "no" if not set. # FW_ALLOW_FW_BROADCAST="no" # FW_IGNORE_FW_BROADCAST="yes" # # 23.) # Allow same class routing per default? # REQUIRES: FW_ROUTE # # Do you want to allow routing between interfaces of the same class # (e.g. between all internet interfaces, or all internal network interfaces) # be default (so without the need setting up FW_FORWARD definitions)? # # Choice: "yes" or "no", defaults to "no" # FW_ALLOW_CLASS_ROUTING="no" # # 25.) # Do you want to load customary rules from a file? # # This is really an expert option. NO HELP WILL BE GIVEN FOR THIS! # READ THE EXAMPLE CUSTOMARY FILE AT /etc/sysconfig/scripts/SuSEfirewall2-custom # #FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom" /var/log/messages: =================== Jun 13 00:25:22 congo syslogd 1.4.1: restart. Jun 13 00:25:24 congo sshd[993]: Server listening on :: port 22. Jun 13 00:25:27 congo kernel: klogd 1.4.1, log source = /proc/kmsg started. Jun 13 00:25:27 congo kernel: Inspecting /boot/System.map-2.4.18-64GB-SMP Jun 13 00:25:27 congo kernel: Loaded 13537 symbols from /boot/System.map-2.4.18-64GB-SMP. Jun 13 00:25:27 congo kernel: Symbols match kernel version 2.4.18. Jun 13 00:25:27 congo kernel: Loaded 458 symbols from 24 modules. Jun 13 00:25:27 congo kernel: ip_tables: (C) 2000-2002 Netfilter core team Jun 13 00:25:27 congo kernel: ip_conntrack (8191 buckets, 65528 max) Jun 13 00:25:27 congo kernel: isapnp: Scanning for PnP cards... Jun 13 00:25:27 congo kernel: isapnp: No Plug & Play device found Jun 13 00:25:27 congo kernel: CSLIP: code copyright 1989 Regents of the University of California Jun 13 00:25:27 congo kernel: ISDN subsystem Rev: 1.1.4.1/1.1.4.1/1.1.4.1/1.1.4.1/1.1.4.1/1.1.4.1 loaded Jun 13 00:25:27 congo kernel: HiSax: Linux Driver for passive ISDN cards Jun 13 00:25:27 congo kernel: HiSax: Version 3.5 (module) Jun 13 00:25:27 congo kernel: HiSax: Layer1 Revision 1.1.4.1 Jun 13 00:25:27 congo kernel: HiSax: Layer2 Revision 1.1.4.1 Jun 13 00:25:27 congo kernel: HiSax: TeiMgr Revision 1.1.4.1 Jun 13 00:25:27 congo kernel: HiSax: Layer3 Revision 1.1.4.1 Jun 13 00:25:27 congo kernel: HiSax: LinkLayer Revision 1.1.4.1 Jun 13 00:25:27 congo kernel: HiSax: Approval certification valid Jun 13 00:25:27 congo kernel: HiSax: Approved with ELSA Microlink PCI cards Jun 13 00:25:27 congo kernel: HiSax: Approved with Eicon Technology Diva 2.01 PCI cards Jun 13 00:25:27 congo kernel: HiSax: Approved with Sedlbauer Speedfax + cards Jun 13 00:25:27 congo kernel: HiSax: Approved with HFC-S PCI A based cards Jun 13 00:25:27 congo kernel: HiSax: Total 1 card defined Jun 13 00:25:27 congo kernel: HiSax: Card 1 Protocol EDSS1 Id=contr0 (0) Jun 13 00:25:27 congo kernel: HiSax: Elsa driver Rev. 1.1.4.1 Jun 13 00:25:27 congo kernel: Elsa: Microlink PCI defined at 0xd400/0xd000 IRQ 5 Jun 13 00:25:27 congo kernel: Elsa: IPAC version 2 Jun 13 00:25:27 congo kernel: Elsa PCI: IRQ 5 count 0 Jun 13 00:25:27 congo kernel: Elsa PCI: IRQ 5 count 3 Jun 13 00:25:27 congo kernel: HiSax: DSS1 Rev. 1.1.4.1 Jun 13 00:25:27 congo kernel: HiSax: 2 channels added Jun 13 00:25:27 congo kernel: HiSax: MAX_WAITING_CALLS added Jun 13 00:25:27 congo kernel: HiSax: debugging flags card 1 set to 4 Jun 13 00:25:27 congo kernel: HiSax: debugging flags card 1 set to 4 Jun 13 00:25:27 congo kernel: dmfe: Davicom DM9xxx net driver, version 1.36.4 (2002-01-17) Jun 13 00:25:27 congo kernel: eth0: Davicom DM9102 at pci00:0a.0, 00:80:ad:70:b9:56, irq 10. Jun 13 00:25:27 congo kernel: ippp, open, slot: 0, minor: 0, state: 0000 Jun 13 00:25:27 congo kernel: ippp_ccp: allocated reset data structure c2eb7000 Jun 13 00:25:27 congo kernel: IPv6 v0.8 for NET4.0 Jun 13 00:25:27 congo kernel: IPv6 over IPv4 tunneling driver Jun 13 00:25:27 congo kernel: parport0: PC-style at 0x378 [PCSPP,EPP] Jun 13 00:25:27 congo kernel: parport0: Printer, Hewlett-Packard HP LaserJet 5L Jun 13 00:25:27 congo kernel: parport_pc: Via 686A parallel port: io=0x378 Jun 13 00:25:27 congo kernel: lp0: using parport0 (polling). Jun 13 00:25:27 congo kernel: lp0: compatibility mode Jun 13 00:25:27 congo /usr/sbin/cron[1104]: (CRON) STARTUP (fork ok) Jun 13 00:25:28 congo smpppd[1087]: smpppd version 0.73 started Jun 13 00:25:30 congo modprobe: modprobe: Can't locate module char-major-10-134 Jun 13 00:25:31 congo SuSEfirewall2: Firewall rules successfully set from /etc/sysconfig/SuSEfirewall2 Jun 13 00:25:32 congo nmbd[1118]: [2003/06/13 00:25:32, 0] nmbd/nmbd_responserecordsdb.c:find_response_record(237) Jun 13 00:25:32 congo nmbd[1118]: find_response_record: response packet id 31678 received with no matching record. Jun 13 00:25:32 congo nmbd[1118]: [2003/06/13 00:25:32, 0] nmbd/nmbd_responserecordsdb.c:find_response_record(237) Jun 13 00:25:32 congo nmbd[1118]: find_response_record: response packet id 31679 received with no matching record. Jun 13 00:25:32 congo /etc/hotplug/net.agent[1002]: No HW description found ... exiting Jun 13 00:25:34 congo kernel: eth0: no IPv6 routers present Jun 13 00:26:57 congo kdm[1348]: pam_unix2: session started for user daniel, service xdm Jun 13 00:27:48 congo modprobe: modprobe: Can't locate module char-major-10-134 Jun 13 00:30:12 congo syslogd 1.4.1: restart. Jun 13 00:30:22 congo su: (to nobody) root on none Jun 13 00:30:22 congo su: pam_unix2: session started for user nobody, service su Jun 13 00:31:13 congo nmbd[1118]: [2003/06/13 00:31:13, 0] nmbd/nmbd_become_lmb.c:become_local_master_stage2(404) Jun 13 00:31:13 congo nmbd[1118]: ***** Jun 13 00:31:13 congo nmbd[1118]: Jun 13 00:31:13 congo nmbd[1118]: Samba name server CONGO is now a local master browser for workgroup ARBEITSGRUPPE on subnet 192.168.1.1 Jun 13 00:31:13 congo nmbd[1118]: Jun 13 00:31:13 congo nmbd[1118]: ***** Jun 13 00:31:26 congo su: pam_unix2: session finished for user nobody, service su

Hallo Micha, Michael Meyer schrieb:

daniel kuesgen wrote:

du brauchst nur 139/tcp. der rest wird über FW_SERVICE_SAMBA geregelt.

Habe ich gemacht.

...

Verwunderlich+erschreckend ist auch, dass die SMB-Shares selbst dann nicht mehr zugänglich sind, wenn ich die Firewall mit 'rcSuSEfirewall stop' herunterfahre.

geht dann vom client ein 'telnet $server 139'?

Nach dem Herunterfahren der Firewall lies sich mit 'telnet 192.168.1.1 139' keine Session aufbauen. Im Gegensatz zu einem Verbindungsaufbau ohne Gegenreaktion bleibt die DOS-Box dunkel. Dies ist allerdings auch bei laufender FW so.

wobei es gereicht hätte, nur den teil zu mailen, der _kein_ kommentar ist.

Stimmt wohl.

...

FW_MASQ_NETS="0/0"

nimm hier nur dein netz. also z.b. 192.168.1.0/24.

Hab ich gemacht.

...

FW_AUTOPROTECT_SERVICES="yes"

setze hier mal testweise auf yes.

Stand bereits auf yes, ich habe mal no eingesetzt.

...

FW_SERVICES_INT_TCP="137 138 139"

hier nur 139

Dito

...

FW_SERVICES_INT_UDP="137 138 139"

Leider hat alles nichts genutzt, die Shares bleiben für den Client verborgen. Allmählich nähere ich mich dem Entschluss, die FW- und IP-Chains-Pakete ganz zu deinstallieren. Keine Fehlermeldungen auf Konsole 10 oder in der /var/log/messages. Gibt es für smbd/nmbd oder iptables/SuSEFW2 Protokoll-Dateien (Name/Pfad), wo abgescmetterte SMB-Aufrufe zu sehen sein könnten? Danke & Gruß, Daniel

..nach weiterem mehrstägigem Gestöber und diverser Posterei von Konfigdateien hat sich mein "Samba <-> Firewall"-Problem heute in Wohlgefallen aufgelöst...ziemlich peinlich: Samba, FW2 *und* Virenscanner können mit einander wunderbar - wenn man in der Systemsteuerung von Windows bei der Konfiguration der Netzwerk- und DFÜ-Verbindungen den Punkt "Client für Microsoft Netzwerke" aktiviert hält - eigentlich logisch, da Samba ja nichts anders als 'nen emulierten Windows-Ressourcenserver (Server Message Block) verkörpert. Nun denn, da hatte ichs mit der Sicherheit in bißchen zu gut gemeint, viel Schaum auf der Linuxseite geschlagen, aber dank der vielen Mithilfe einiges gelernt, und nun kann ich noch mit den diversen internen tcp/udp-Ports herumtrixen., was ich alles zuziehen kann bis dem Win-Client wieder die Puste ausgeht... Gruß, Daniel -- Veneno da Lata DAS GIFT AUS DER DOSE - oder: afrobrasilianische Taktschlemmereien mit Biss! http://www.patuscada.de Tim Sein Lada - Hinhören und Fieber kriegen. http://www.tim-sein-lada.de

Hallo ihr Feuermänner, inzwischen habe ich drei Antworten bekommen von Micha, Christian und Robert und schicke die angeforderten Status- oder Logabfragen netstat -lnp |grep 13 /var/log/samba/smbd.log /var/log/samba/nbmd.log /var/log/warn /etc/samba/smb.conf /etc/samba/SuSEConfig2. Bemerkung an Schöpp: Ich habe die SuSEFW2 mit ip*tables*, weiß das aber auch noch nicht lange. Scheint möglich, dass ich die /etc/sysconfig/SuSEConfig2 (andere habe ich nicht editiert) inzwischen so verhunzt habe, dass nix mehr geht. Wenn aber keine Bolzen vom Typ 'klar, kann doch nicht...' zu finden sind, werde ich sie wohl mit der /usr/share/doc/packages/SuSEfirewall2/SuSEfirewall2.conf überbügeln und dann nach dem Rezept von Robert mit YaST2 konfigurieren. Frage an Robert: Reicht bei der Einngabe ins "Expertenfenster" von YaST2| ...| Firewall |Zusätzliche Dienste die Eingabe der mit Leerzeichen getrennten Portnummern, oder müssen smbd, nmbd, tcp/udp dort noch ausführlich angegeben werden? Nach meiner Deutung werden alle für Samba notwendigen Ports für das interne Netz zugelassen. Vielen Dank für Eure Bemühungen!! - Gruß, Daniel netstat -lnp |grep 13 (zeigt TCP-Port 137, 138 und 139): ===================== congo:/tmp # cat netstat_lnpgrep13\* tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN 687/smbd udp 0 0 192.168.1.1:137 0.0.0.0:* 680/nmbd udp 0 0 0.0.0.0:137 0.0.0.0:* 680/nmbd udp 0 0 192.168.1.1:138 0.0.0.0:* 680/nmbd udp 0 0 0.0.0.0:138 0.0.0.0:* 680/nmbd /var/log/samba/smbd.log (nur aktuelle): ======================== [2003/06/15 19:52:30, 0] smbd/server.c:main(698) smbd version 2.2.3a started. Copyright Andrew Tridgell and the Samba Team 1992-2002 /var/log/samba/nbmd.log: ======================= [2003/06/15 19:52:30, 0] nmbd/nmbd.c:main(783) Netbios nameserver version 2.2.3a started. Copyright Andrew Tridgell and the Samba Team 1994-2002 [2003/06/15 19:52:35, 0] nmbd/nmbd_responserecordsdb.c:find_response_record(237) find_response_record: response packet id 12427 received with no matching record. [2003/06/15 19:52:35, 0] nmbd/nmbd_responserecordsdb.c:find_response_record(237) find_response_record: response packet id 12428 received with no matching record. [2003/06/15 19:58:16, 0] nmbd/nmbd_become_lmb.c:become_local_master_stage2(404) ***** Samba name server CONGO is now a local master browser for workgroup ARBEITSGRUPPE on subnet 192.168.1.1 ***** /var/log/warn: ============== un 15 19:52:30 congo kernel: eth0: Tx timeout - resetting Jun 15 19:52:34 congo modprobe: modprobe: Can't locate module char-major-10-134 Jun 15 19:52:34 congo kernel: eth0: Tx timeout - resetting Jun 15 19:52:35 congo nmbd[680]: [2003/06/15 19:52:35, 0] nmbd/nmbd_responserecordsdb.c:find_response_record(237) Jun 15 19:52:35 congo nmbd[680]: find_response_record: response packet id 12427 received with no matching record. Jun 15 19:52:35 congo nmbd[680]: [2003/06/15 19:52:35, 0] nmbd/nmbd_responserecordsdb.c:find_response_record(237) Jun 15 19:52:35 congo nmbd[680]: find_response_record: response packet id 12428 received with no matching record. Jun 15 19:52:38 congo kernel: eth0: Tx timeout - resetting Jun 15 19:53:47 congo kernel: eth0: Tx timeout - resetting Jun 15 19:54:01 congo fetchnews[1061]: can't stat /var/spool/news/leaf.node/groupinfo: No such file or directory Jun 15 19:54:01 congo fetchnews[1061]: Reading all newsgroups failed Jun 15 19:55:47 congo kernel: eth0: Tx timeout - resetting Jun 15 19:57:47 congo kernel: eth0: Tx timeout - resetting Jun 15 19:58:14 congo last message repeated 5 times Jun 15 19:58:16 congo nmbd[680]: [2003/06/15 19:58:16, 0] nmbd/nmbd_become_lmb.c:become_local_master_stage2(404) Jun 15 19:58:16 congo nmbd[680]: ***** Jun 15 19:58:16 congo nmbd[680]: Jun 15 19:58:16 congo nmbd[680]: Samba name server CONGO is now a local master browser for workgroup ARBEITSGRUPPE on subnet 192.168.1.1 Jun 15 19:58:16 congo nmbd[680]: Jun 15 19:58:16 congo nmbd[680]: ***** smb.conf: ========= (snip) [global] workgroup = arbeitsgruppe os level = 2 security = user encrypt passwords = Yes guest account = Nobody map to guest = Bad User # This tells samba to use the file smbusers for user mapping. ; username map = /etc/samba/smbusers # This tells samba to write log files per machine. ; log file = /var/log/samba/%m # This sets an alternate log level. Default is 2. ; log level = 3 # Uncomment the following, if you want to use an existing NT-Server to # authenticate users, but don't forget that you also have to create them # locally! ; security = server ; password server = 192.168.1.10 printing = LPRNG printcap name = /etc/printcap load printers = Yes # These settings are a suggestion for a local network. Cf. section # 'socket options' in the man page of smb.conf and socket(7). socket options = SO_KEEPALIVE IPTOS_LOWDELAY TCP_NODELAY # Uncomment this, if you want to integrate your server # into an existing net e.g. with NT-WS to prevent nettraffic ; local master = No # Please uncomment the following entry and replace the ip number and # netmask with the values of your network interface configuration. ; interfaces = 192.168.1.1/255.255.255.0 # If you want Samba to act as a wins server, please set # 'wins support' to yes. wins support = No # If you want Samba to use an existing wins server, please uncomment the # following line and replace the dummy with the wins server's ip number. ; wins server = 192.168.1.1 # Set these two parameters to your DOS code page and appropriate UNIX # character set. These values are for west European languages (Latin-9) # UNIX character and MS-DOS Latin 1 code page. character set = ISO8859-15 client code page = 850 # This is a simple measure against Nimba Worm. Cf. README.Win32-Viruses veto files = /*.eml/*.nws/riched20.dll/*.{*}/ # Do you wan't samba to act as a logon-server for your windows 95/98 # clients, so uncomment the following: ; domain logons = Yes ; domain master = Yes # For a specific logon script per user ; logon script = %U.bat # For a specific logon script per machine ; logon script = %m.bat # Where to store the logon scripts. ;[netlogon] ; comment = Network Logon Service ; path = /var/lib/samba/netlogon # Where profiles of Windows 9x systems are stored. # First example for a centralized place. ; logon home = \\%L\profiles\%U # Second example for a subdirectory of the users home. ; logon home = \\%L\%U\profile # Where profiles of Windows NT systems are stored. ; logon path = \\%L\profiles\%U # Extra share for profiles. Default is the home of the user. ;[profiles] ; comment = Network Profiles Service ; path = /var/lib/samba/profiles ; browseable = No [homes] comment = Home Directories read only = No create mask = 0640 directory mask = 0750 browseable = No # The following share gives all users access to the Server's CD drive, # assuming it is mounted under /media/cdrom. To enable this share, # please remove the semicolons before the lines [cdrecorder] comment = Linux CD-ROM path = /media/cdrecorder locking = No browseable = Yes [dvd] comment = Linux DVD path = /media/dvd locking = No browseable = Yes [printers] comment = All Printers path = /var/tmp create mask = 0600 printable = Yes browseable = Yes /etc/sysconfig/SuSEConfig2: =========================== (...snip...) # # 1.) # Should the Firewall be started? # # This setting is done via the links in the /etc/init.d/rc?.d runlevel # directories, which can be tweaked with a runlevel editor (or manually) # # 2.) # Which is the interface that points to the internet/untrusted networks? # # Enter all the network devices here which are untrusted. # # Choice: any number of devices, seperated by a space # e.g. "eth0", "ippp0 ippp1 eth0:1" # FW_DEV_EXT="ippp0" # # 3.) # Which is the interface that points to the internal network? # # Enter all the network devices here which are trusted. # If you are not connected to a trusted network (e.g. you have just a # dialup) leave this empty. # # Choice: leave empty or any number of devices, seperated by a space # e.g. "tr0", "eth0 eth1 eth1:1" or "" # FW_DEV_INT="eth0" # # 4.) # Which is the interface that points to the dmz or dialup network? # # Enter all the network devices here which point to the dmz/dialups. # A "dmz" is a special, seperated network, which is only connected to the # firewall, and should be reachable from the internet to provide services, # e.g. WWW, Mail, etc. and hence are at risk from attacks. # See /usr/share/doc/packages/SuSEfirewall2/EXAMPLES for an example. # # Special note: You have to configure FW_FORWARD to define the services # which should be available to the internet and set FW_ROUTE to yes. # # Choice: leave empty or any number of devices, seperated by a space # e.g. "tr0", "eth0 eth1 eth1:1" or "" # FW_DEV_DMZ="" # # 5.) # Should routing between the internet, dmz and internal network be activated? # REQUIRES: FW_DEV_INT or FW_DEV_DMZ # # You need only set this to yes, if you either want to masquerade internal # machines or allow access to the dmz (or internal machines, but this is not # a good idea). This option supersedes IP_FORWARD from # /etc/sysconfig/network/options # -- Veneno da Lata DAS GIFT AUS DER DOSE - oder: afrobrasilianische Taktschlemmereien mit Biss! http://www.patuscada.de Tim Sein Lada - Hinhören und Fieber kriegen. http://www.tim-sein-lada.de

daniel kuesgen wrote:

...

netstat -lnp |grep 13 (zeigt TCP-Port 137, 138 und 139): ===================== congo:/tmp # cat netstat_lnpgrep13\* tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN 687/smbd

ok, samba läuft.

...

/var/log/warn: ============== un 15 19:52:30 congo kernel: eth0: Tx timeout - resetting

hmm ... was ist denn das für ne NIC? Eine Davicom Etherexpress 10/100, RJ45, lief bislang wie geschmiert

Michael Meyer schrieb: trotz ewiger Resetmeldungen. HTTP uns Browser geht ja auch noch.

mach auch mal ein 'iptables -L -n | grep 139'.

micha

'iptables -L -n | grep 139': ============================ congo:~ # iptables -L -n |grep 139 congo:~ # Ich würde sagen: Rien! Und was tun ?? Gruß, Daniel -- Veneno da Lata DAS GIFT AUS DER DOSE - oder: afrobrasilianische Taktschlemmereien mit Biss! http://www.patuscada.de Tim Sein Lada - Hinhören und Fieber kriegen. http://www.tim-sein-lada.de