Setting up Samba with security in mind

 

RedHat Linux 7.0, 7.3, 8.0 Samba Installs

January 31, 2003

John Hurst

These instructions are written from the perspective of a RedHat Linux machine that is a guest of a Windows 2000/XP host machine via VMware 3.2.0. The instructions have worked for me, but (1) I may have inadvertently left out details, and (2) they should work for Samba in other Linux systems.

Samba needs three packages (such as):

Server: samba 2.2.7-1.7.3 From: System Environment/Daemons

Common: samba-common 2.2.7-1.7.3 From: Applications/System

Client: samba-client 2.2.7-1.7.3 From: Applications/System

Use Gnome RPM to view the Application Packages. The default window shows what has been installed. Samba Common and Client are usually installed in a default RedHat installation. Generally, rpm -qa | grep samba should turn up whether or not the packages are installed.

Install Samba Server after the initial RedHat install by clicking on Install in the menu bar and installing. Again, use rpm -qa | grep samba to check that all packages are installed.

Follow the steps below:

1. In Linux, there is a file smb.conf in /etc/samba. Edit this file for the following:

(a) change workgroup = MYGROUP to the NT workgroup that you use.

(b) uncomment the "hosts allow" line, add the guest IP (you can use a class C IP)

(c) uncomment the "guest account" line, add the user.

Note: I used "root" because initially I could not get a regular ID to work. I have made a regular ID work, but I prefer "root" in any event. This will be a security risk if your Linux box is on and connected to the Internet without adequate firewall and security. Adequate firewall protection is necessary in any event, so just be sure you have it.

(d) uncomment the lines "encrypt passwords = yes" and "smb passwd ... "

Note: You do NOT want to change your NT/2000 guest to work in plain text. Some newsgroup articles suggested this as any easy workaround, but I do not agree.

(e) In the Share section in [homes], change browseable to yes. Add path = /root here, or create a separate user elsewhere in this file.

2. Make the smbpasswd file:

(a) cat /etc/passwd | mksmbpasswd.sh > /etc/samba/smbpasswd

(b) Edit the smbpasswd file and remove any id's except root and obvious user id's.

(c) Create samba passwords for the users in (b): smbpasswd userid It will prompt for passwords.

3. Start, or restart the Samba server. Easiest way is service smb restart. If it wasn't running, the shutdown will fail (OK), and the restart will work. In RedHat 7, the server service (smb) started automatically on reboot. In RedHat 7.3, go to the Services application and enable the smb service.

To map drives between machines, follow the steps below.

In the host machine:

In Windows Explorer, select tools -> map network drive Map the IP and home folder of the Linux mahchine, i.e., \\192.168.exact.ip\root. Enter root and password as prompted, and you should see the Linux drive mount within Explorer.

In the guest machine:

Make sure your lmosts file is up-to-date with host IP's. There can only be one reference to the host machine.

mount -t smbfs -o username=userid,password=passwd //pcname/C$ /home will mount your NT/2000 C: file structure under /home and you can deal with files there.

Unmount with umount //pcname/C$

Also, smbclient //pcname/C$ -U signon_id will find the drive and ask for the password. You get the smb\> prompt. Type help at this prompt to see the commands you can execute including dir and get. I have moved files with get just fine.

Use mount.smbsf to see the commands, help and example for this command.

 


GSO
Written on Saturday, 03 October 2009 20:08 by GSO

Viewed 151 times so far.
Like this? Tweet it to your followers!

Rate this article

Latest articles from GSO

Latest 'tweets' from GovernmentSecurity

  • News Update: Cyber war is coming, the impact could be huge: CBS News reports that cyber.. http://bit.ly/1tx1kr | #Security Link Monday, 09 November 2009 07:35
  • News Update: Tenable Network #Security Podcast - Episode 11: Welcome to the Tenable Netw.. http://bit.ly/2Iqd6G | Security Link Monday, 09 November 2009 07:35
  • News Update: Consent will be required for cookies in Europe: EDITORIAL: A law that dema.. http://bit.ly/3JYgip | #Security Link Monday, 09 November 2009 07:35
  • News Update: CBS 60 Minutes tackles cyber-terrorism: Could hackers get into the compute.. http://bit.ly/2d5Y21 | #Security Link Monday, 09 November 2009 07:35
  • Blog Update: We have launched the new GovernmentSecurity.org: We decided to launch th.. http://bit.ly/2G1SSF | #Security Link Saturday, 07 November 2009 17:38
blog comments powered by Disqus

Site Search

Disqus Tools