<html>
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 10 (filtered)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
p
{margin-right:0in;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman";}
span.EmailStyle17
{font-family:Arial;
color:windowtext;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p><font size=2 face="Times New Roman"><span style='font-size:10.0pt'>Hello, my
name is </span></font><font size=2><span style='font-size:10.0pt'>Carlos
Navarro</span></font><font size=2><span style='font-size:10.0pt'>. I’m
using fireholl in our proxy server and I can’t set up correctly the samba
service. This is not really important in this case, cause I only need samba to share
files (software, updates, logs, configs, etc) between my computer and the
server. Since the server is not a file server, I start the service manually and
stop it manually using ssh. But I want to know the solution for future
reference.</span></font></p>
<p><font size=2 face="Times New Roman"><span style='font-size:10.0pt'>Ok my
problem, simple. My linux box can connect to windows shares and even mount them,
but my windows hosts cannot connect to my linux host, and I know the samba has
been set up correctly. </span></font></p>
<p><font size=2 face="Times New Roman"><span style='font-size:10.0pt'>Ok, in
the manual it says that there are two solutions, a hack and a trust
relationship. I cannot set up any kind of trust relationship between the proxy
and any other system. So I need to know the hack. I don’t care if I open
those high ports because they are going to listen to my network and not to internet.
And, as I said before, most of the time the samba service is not running. And I
want to know this for future reference.</span></font></p>
<p><font size=2 face="Times New Roman"><span style='font-size:10.0pt'>By the
way, this is the second time that I write to you. The first time I was able to
solve the problem and the server is perfectly setup. Fireholl just help me A
LOT!! I don’t know too much about iptables and without fireholl, well we
would still be using the well so known insecure Micro$oft server to connect to
internet. Thanks a lot!! Because of you, we are running linux! =)</span></font></p>
<p><font size=1 face="Times New Roman"><span style='font-size:8.0pt'>“NETBIOS
initiates based on the broadcast address of an interface (request goes to
broadcast address) but the server responds from its own IP address. This makes
the <b><span style='font-weight:bold'>server samba accept</span></b> statement <b><span
style='font-weight:bold'>drop the server reply</span></b>, because of the way
the iptables connection tracker works. </span></font></p>
<p><b><font size=1 face="Times New Roman"><span style='font-size:8.0pt;
font-weight:bold'>This service definition includes a hack,</span></font></b><font
size=1><span style='font-size:8.0pt'> that allows a linux samba server to
respond correctly in such situations, <b><span style='font-weight:bold'>by
allowing new outgoing connections</span></b> from the well known <a
href="http://firehol.sourceforge.net/services.html?#netbios_ns">netbios_ns</a>
port <b><span style='font-weight:bold'>to the clients high ports</span></b>. </span></font></p>
<p><font size=1 face="Times New Roman"><span style='font-size:8.0pt'>However,
for clients and routers this hack is not applied because it would open all unpriviliged
ports to the samba server.</span></font><font size=1><span style='font-size:
8.0pt'> The only solution to overcome the problem in such cases (routers or
clients) is to build a trust relationship between the samba servers and clients.”</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>
</div>
</body>
</html>