RE: Samba & IPTables
by Trimble, Nathan G
Well, I thought this might be a good users
list to attend but now I'm not sure. Some people
feel the need to YELL and SHOUT, and attempt to
publicly humiliate. I'll stick to my LUG where
people use capable email clients. Goodbye.
Nate
-----Original Message-----
From: Rick Johnson [mailto:rjohnson@medata.com]
Sent: Friday, August 01, 2003 4:39 PM
To: rhl-list(a)redhat.com
Subject: Re: Samba & IPTables
Trimble, Nathan G wrote:
<unwrapped lines snipped>
> PLEASE WRAP YOUR LINES at less than 80 characters per line.
What part of wrap lines doesn't he get? - two replies both unwrapped.
-Rick
--
Rick Johnson, RHCE #807302311706007 - rjohnson(a)medata.com
Linux/Network Administrator - Medata, Inc.
PGP Public Key: https://mail.medata.com/pgp/rjohnson.asc
--
Rhl-list mailing list
Rhl-list(a)redhat.com
http://www.redhat.com/mailman/listinfo/rhl-list
20 years, 8 months
RHL with User Mode Linux kernel?
by Robin Green
Possibly a nutty idea, but:
Has anyone ever tried installing RHL as usual and then swapping out
the Red Hat kernel for a User Mode Linux kernel and running one copy
of RHL "on top of" another, separate Linux installation?
Did it boot? - after some fiddling of course! How fast? Could you
connect to the host X server and run KDE? Issues that required
configuration changes?
I don't want to use a "prebuilt" image from the UML site, I want
to use the official RHL ISOs, so that I can set up the guest
system how I want it (and learn whatever's necessary to set up UML
"by hand" in the process).
I'd like to run an "almost-pristine" copy of RHL (current beta/release
version, and previous release version, which right now would be RH9)
"on top of" my main system (which is a mishmash of packages from
various RPM repositories). I think UML has something like a
copy-on-write feature which allows you to keep the guest system
pristine (like VMWare can).
This would be a godsend for: reproducing and filing bugs (rather than
having to annoy people by saying "Um, I've got a funny kind of mix of
packages from RH7,8,9, Rawhide and Severn here, with some extra custom
packages", I could say "This is the output on a freshly-installed RHL
system" - which makes the bug less likely to be caused by a system
configuration error); and for building RPMs for distribution (making
absolutely sure that the build is against a pristine system, so no
non-standard packages are there to screw up the build).
UML is also, of course, damn useful for trying out experimental or
in-development kernel patches/modules/kernels which might cause
kernel crashes or trash data, as long as they don't need direct
hardware access. Things like enbd, kernel hooks for userland
filesystems, etc.
All without having to reboot and without having to waste resources on
a second physical machine.
I used to use VMWare for trying and using out different distros, but
this is obviously closed-source and expensive. Also, from an
engineering point of view UML is a much cleaner approach than
VMWare's, for a variety of reasons.
Of course, the fact that the kernel is UML rather than the RedHat
kernel could be a source of differences, and UML can't do everything
that a real kernel can do (yet) but I still think it would be
valuable.
If there are a lot of configuration issues, perhaps a package could be
produced that sets up sensible defaults. OR EVEN - ambitious project
here - hack anaconda so that an ISO could somehow boot (with a little
helper script and an on-ISO UML image) AND install itself, all within
UML! That would be a fantastic hack! And it would be something to set
Red Hat apart from other distros (for about 1 version ;) [*]
--
Robin
[*] Actually, I've just found out that RH8 had a UML _kernel_
included, but this was dropped in RH9 due to patching issues, but it
will be back because it's in kernel 2.6 - see:
"Red Hat Linux 9 Technical Changes - or when the RELEASE-NOTES are
just not enough"
http://www.gurulabs.com/RedHatLinux9-review.html
20 years, 9 months
Re: Samba & IPTables (fwd)
by Dag Wieers
On Sat, 2 Aug 2003, Charles Bronson wrote:
> > It is a great tool to learn more about networking.
> You are correct when all networking activities are limited to the Well Known
> Ports. However, what happens when a user gets a request for access to a port
> above 1024? This could be someone trying to hack their pc or it could be a
> legitimate use.
What legitimate use access on port > 1024 (on a unknown port) ?
I think it is fairly safe to say that if the user wasn't expecting
anything to happen, he can deny it temporarily (and maybe that should be
the default thing to suggest/advice).
> Let's use Bob and Alice (avg users) in an example:
> Bob wants to access the faimily computer from work so he installs <insert
> Generic Remote Access Tool name here>. The next day Bob is at work and lights up
> the GRAT client. Alice is home surfing the web and a pop-up asks her if she
> should allow access to port 2029. Pretend your Alice and make the call, what
> would you do?
Well, I think you're not talking about the common case here already. I'm
sure that if bob knows how to install GRAT and was planning to connect to
home on a system that he shares with his wife. He prepared the personal
firewall sufficiently.
Anyway, in this case the pop-up probably says something like:
We noticed someone (from firewall.bobswork.com) trying to connect
to 'Generic Remote Access Tool' (on port 2029).
This traffic is unknown by the firewall and therefor could be
dangerouse. We advise not to allow it unless you understand the
consequences.
Do You want to allow access to Generic Remote Access Tool from
firewall.bobswork.com
[Yes] [*No*] [Customize]
If it was a known protocol the personal firewall could give more
information about what it is used for. (Warning: this is a remote
administration tool, someone with access can completely control your
machine from remote.)
bob is fairly stupid if he installed the personal firewall and the GRAT
server and didn't think of this before going to work. He still can call
his wife and tell her to click on Yes ;)
Let me also add that if nothing is listening on a port the traffic is
dropped silently (and logged). My biggest concern is that you're denying
the concept of personal firewalls and I don't have time to argue for the
sake of arguing.
I did a quick search to get a screenshot of ZoneAlarm. There are better
examples, I'm sure.
http://antivirus.about.com/library/reviews/aafprzone.htm
> > Lokkit is a very limited tool. It is not functional for most of the home
> > users and I don't think it is intended to be. Someone in this thread
> > already refered to it (not supporting samba).
>
> If you look at my previous reply you will see that I already agree with you on
> this point.
Right, after first saying "This statement is just plain wrong. IPTables is
a VERY powerful tool.". Next time you better not use strong language if
you're actually agreeing with me.
I think you understand what I was trying to suggest so for me the thread
ends here. Feel free to find some other cornercases ;)
Kind regards,
-- dag wieers, dag(a)wieers.com, http://dag.wieers.com/ --
[Any errors in spelling, tact or fact are transmission errors]
20 years, 9 months
RE: Samba & IPTables
by Epps, Aaron M.
This suggestion is for "Home Users"... If someone's a SysAdmin and you have issues with figuring out Samba & IPTables then you shouldn't be one. IPTables are enabled by default, how is a user going to know that they have to stop the iptables service in order for Network Browsing to work? Also, I don't think just shutting off IPTables is a suitable solution, and even if they did shut off IPTables how many people do you know that have physical firewalls setup at home? If you also read my note, I suggested prompting the user if they wanted to open these ports, not to automagiclly go ahead an do it without their knowledge.
-----Original Message-----
From: Tom Diehl [mailto:tdiehl@rogueind.com]
Sent: Friday, August 01, 2003 11:24 AM
To: 'rhl-list(a)redhat.com'
Subject: Re: Samba & IPTables
Hi,
PLEASE WRAP YOUR LINES at less than 80 characters per line.
On Fri, 1 Aug 2003, Epps, Aaron M. wrote:
> Here's my suggestion... When a user configures their server to have Samba start on boot, don't you think they'd probably want to open the appropriate ports so that people can connect to their Samba Server? I think that when I uses clicks on the checkbox in the Services Config Tool it should prompt the user, asking them if they'd like to open the appropriate ports in their firewall for Samba (137-139). Otherwise, if you don't realize that IPTables is what's stopping your Samba Server from being available in "Network Neighborhood" you'll have to dig around and manually configure iptables, which isn't necessarily the most intuitive thing in the world. This could also be done for similar servers that require certain ports to be opened up (SSH, FTP, Apache, Etc...) Thoughts anyone?
>
What you auggest would be bad. Think about the case where you have 2 nic's in a machine and you have things configured to automagically open up the ports to the outside world. If you have a single machine behand a firewall and the complexities of samba + iptables are too much to handle then turn off iptables. If you are paranoid enough to want iptables enabled on such a machine then you should be paranoid enough to not want things messing with your rules without your knowledge. What you are suggesting would end up being a support nightmare. Yes I know they way it is now is also a problem but at least now it is simple to say turn off iptables and try again. If it now works then you know where to look.
HTH,
--
......Tom Registered Linux User #14522 http://counter.li.org
tdiehl(a)rogueind.com My current SpamTrap -------> mtd123(a)rogueind.com
--
Rhl-list mailing list
Rhl-list(a)redhat.com
http://www.redhat.com/mailman/listinfo/rhl-list
20 years, 9 months
RE: Samba & IPTables
by Trimble, Nathan G
Redhat indirectly addressed this issue before they took down their rhl.redhat.com site. It mentioned the need for an improved GUI for the firewall/iptables interface. One problem the current app has is that it doesn't include smb ports in it's list. You have to type it in after figuring out what ports smb/CIFS run on. This can be bothersome. Note it's not critical but a nusiance.
To get the smb up and running right now on a Redhat box (using their "tools") you have to do three things.
1. Configure smb.conf using redhat-config-samba.
2. Turn the service on using redhat-config-services.
3. Punch a hole in your firewall using redhat-config-securitylevel
This is 1 too many steps. Here is why:
If you're creating "shares" on your machine it should be assumed you want the service to run...So it should get enabled when redhat-config-samba is run and configured. I don't agree with magically putting holes in the IP/Tables. How about making the redhat-config-securitylevel interface easier to use and more powerful and then giving the user some instruction on enabling access through smb ports.
My two cents.
-----Original Message-----
From: Tom Diehl [mailto:tdiehl@rogueind.com]
Sent: Friday, August 01, 2003 9:24 AM
To: 'rhl-list(a)redhat.com'
Subject: Re: Samba & IPTables
Hi,
PLEASE WRAP YOUR LINES at less than 80 characters per line.
On Fri, 1 Aug 2003, Epps, Aaron M. wrote:
> Here's my suggestion... When a user configures their server to have Samba start on boot, don't you think they'd probably want to open the appropriate ports so that people can connect to their Samba Server? I think that when I uses clicks on the checkbox in the Services Config Tool it should prompt the user, asking them if they'd like to open the appropriate ports in their firewall for Samba (137-139). Otherwise, if you don't realize that IPTables is what's stopping your Samba Server from being available in "Network Neighborhood" you'll have to dig around and manually configure iptables, which isn't necessarily the most intuitive thing in the world. This could also be done for similar servers that require certain ports to be opened up (SSH, FTP, Apache, Etc...) Thoughts anyone?
>
What you auggest would be bad. Think about the case where you have 2 nic's
in a machine and you have things configured to automagically open up the ports
to the outside world. If you have a single machine behand a firewall and
the complexities of samba + iptables are too much to handle then turn off
iptables. If you are paranoid enough to want iptables enabled on such a machine
then you should be paranoid enough to not want things messing with your rules
without your knowledge. What you are suggesting would end up being a support
nightmare. Yes I know they way it is now is also a problem but at least now
it is simple to say turn off iptables and try again. If it now works then
you know where to look.
HTH,
--
......Tom Registered Linux User #14522 http://counter.li.org
tdiehl(a)rogueind.com My current SpamTrap -------> mtd123(a)rogueind.com
--
Rhl-list mailing list
Rhl-list(a)redhat.com
http://www.redhat.com/mailman/listinfo/rhl-list
20 years, 9 months
RE: File systems
by Jaime Diaz
I'm not sure about that. But I'm sure that it is not possible to do it
through Anaconda.
-----Original Message-----
From: Emmanuel Seyman [mailto:seyman@wanadoo.fr]
Sent: Viernes, 01 de Agosto de 2003 04:58 p.m.
To: rhl-list(a)redhat.com
Subject: Re: File systems
On Fri, Aug 01, 2003 at 04:56:44PM -0300, Jaime Diaz wrote:
>
> I would love the possibility of choosing other filesystems besides ext2
and
> ext3. Specifically ReiserFS.
Isn't this already possible by typing "linux reiserfs" to start
the installation?
Emmanuel
--
Rhl-list mailing list
Rhl-list(a)redhat.com
http://www.redhat.com/mailman/listinfo/rhl-list
20 years, 9 months
Samba & IPTables
by Epps, Aaron M.
Here's my suggestion... When a user configures their server to have Samba start on boot, don't you think they'd probably want to open the appropriate ports so that people can connect to their Samba Server? I think that when I uses clicks on the checkbox in the Services Config Tool it should prompt the user, asking them if they'd like to open the appropriate ports in their firewall for Samba (137-139). Otherwise, if you don't realize that IPTables is what's stopping your Samba Server from being available in "Network Neighborhood" you'll have to dig around and manually configure iptables, which isn't necessarily the most intuitive thing in the world. This could also be done for similar servers that require certain ports to be opened up (SSH, FTP, Apache, Etc...) Thoughts anyone?
20 years, 9 months