RE: Samba & IPTables

[Epps, Aaron M.]

	This suggestion is for "Home Users"... If someone's a SysAdmin and you have
issues with figuring out Samba & IPTables then you shouldn't be one.  IPTables are
enabled by default, how is a user going to know that they have to stop the iptables
service in order for Network Browsing to work?  Also, I don't think just shutting off
IPTables is a suitable solution, and even if they did shut off IPTables how many people do
you know that have physical firewalls setup at home?  If you also read my note, I
suggested prompting the user if they wanted to open these ports, not to automagiclly go
ahead an do it without their knowledge.

-----Original Message-----
From: Tom Diehl [mailto:[e-mail]] 
Sent: Friday, August 01, 2003 11:24 AM
To: 'rhl-list(a)redhat.com'
Subject: Re: Samba & IPTables

Hi,

PLEASE WRAP YOUR LINES at less than 80 characters per line.

On Fri, 1 Aug 2003, Epps, Aaron M. wrote:

>      Here's my suggestion...  When a user configures their server
> to have Samba start on boot, don't you think they'd probably want to open the
> appropriate ports so that people can connect to their Samba Server?  I think that when I
> uses clicks on the checkbox in the Services Config Tool it should prompt the user, asking
> them if they'd like to open the appropriate ports in their firewall for Samba
> (137-139).   Otherwise, if you don't realize that IPTables is what's stopping your
> Samba Server from being available in "Network Neighborhood" you'll have to
> dig around and manually configure iptables, which isn't necessarily the most intuitive
> thing in the world.   This could also be done for similar servers that require certain
> ports to be opened up (SSH, FTP, Apache, Etc...)  Thoughts anyone? 
>   
What you auggest would be bad. Think about the case where you have 2 nic's in a
machine and you have things configured to automagically open up the ports to the outside
world. If you have a single machine behand a firewall and the complexities of samba +
iptables are too much to handle then turn off iptables. If you are paranoid enough to want
iptables enabled on such a machine then you should be paranoid enough to not want things
messing with your rules without your knowledge. What you are suggesting would end up being
a support nightmare. Yes I know they way it is now is also a problem but at least now it
is simple to say turn off iptables and try again. If it now works then you know where to
look.

HTH,

-- 
......Tom		Registered Linux User #14522	http://counter.li.org
tdiehl(a)rogueind.com	My current SpamTrap ------->	mtd123(a)rogueind.com


--
Rhl-list mailing list
Rhl-list(a)redhat.com
http://www.redhat.com/mailman/listinfo/rhl-list

Samba & IPTables

[Dag Wieers]

On Fri, 1 Aug 2003, Epps, Aaron M. wrote:

PLEASE WRAP YOUR LINES at less than 80 characters per line.

>  This suggestion is for "Home Users"... If someone's a
> SysAdmin and you 
>  have issues with figuring out Samba & IPTables then you shouldn't be 
>  one.  
>
>  IPTables are enabled by default, how is a user going to know that they 
>  have to stop the iptables service in order for Network Browsing to work?  
>
>  Also, I don't think just shutting off IPTables is a suitable solution, 
>  and even if they did shut off IPTables how many people do you know that 
>  have physical firewalls setup at home?  If you also read my note, I 
> suggested prompting the user if they wanted to open these ports, not to 
>  automagiclly go ahead an do it without their knowledge. 
Maybe a personal firewall approach is needed. Just like it pop-ups a 
yes/no dialog box for every outgoing or incoming connection such a program 
could pop-up and ask to allow incoming calls for certain listen ports.
(The moment a program listens on a port an event is triggered)

And then you can decide to allow it from a single address, a network 
range or decide to allow it on a case by case basis.

That's probably what 'Home Users' would expect anyway. The current 
iptables firewall from Red Hat is a basic tool and limited in 
functionality.

Kind regards,
--   dag wieers,  dag(a)wieers.com,  http://dag.wieers.com/   --
[Any errors in spelling, tact or fact are transmission errors]

Samba & IPTables

[Charles Bronson]

Dag Wieers wrote:
>  On Fri, 1 Aug 2003, Epps, Aaron M. wrote:
>  
>  PLEASE WRAP YOUR LINES at less than 80 characters per line.
>  
>  
> >This suggestion is for "Home Users"... If someone's a SysAdmin and you 
> >have issues with figuring out Samba & IPTables then you shouldn't be 
> >one.  
> >
> >IPTables are enabled by default, how is a user going to know that they 
> >have to stop the iptables service in order for Network Browsing to work?  
> > 
This is the base problem. Networking and TCP/IP are duly complex. Any workable

solution has to reduce the following concepts to a level that can be understood 
by a laymen without hindering the capabilities of IPTables:

1- multiple interfaces used for different networks(either Internet on one and 
home network on the other or one used when you are on your work network and the 
other used when you are on your home network).

2- IP addresses, subnets, masks

3- what ports are used for what services (the names are not always very obvious)


> >Also, I don't think just shutting off IPTables is a suitable
> solution, 
> >and even if they did shut off IPTables how many people do you know that 
> >have physical firewalls setup at home?  If you also read my note, I 
> >suggested prompting the user if they wanted to open these ports, not to 
> >automagiclly go ahead an do it without their knowledge. 
In keeping with my list
above, how do you ask a laymen whether it is ok to open 
these ports and have them fully understand the implications? For example if the 
computer in question is on a home network with some kind of firewall between 
them and the Internet then opening these ports will be fine. However, if they 
simply have a hub sharing their Internet connection and they are paying for 
multiple IP addresses then they will be attacked almost immediately if they open 
these ports.

>  Maybe a personal firewall approach is needed. Just like it pop-ups a
>
>  yes/no dialog box for every outgoing or incoming connection such a program 
>  could pop-up and ask to allow incoming calls for certain listen ports.
>  (The moment a program listens on a port an event is triggered) 
I will refer back to
my point about explaining to laymen first of all what a 
"port" is and then what each requested port is used for.


>  And then you can decide to allow it from a single address, a network
>
>  range or decide to allow it on a case by case basis. 
This dips heavily into
understanding the complexities of TCP/IP network addressing.


>  That's probably what 'Home Users' would expect anyway.
> The current 
>  iptables firewall from Red Hat is a basic tool and limited in 
>  functionality. 
This statement is just plain wrong. IPTables is a VERY powerful
tool. Are you 
maybe referring to the firewall configuration tool? If so it is sufficiently 
functional for a home user although using it properly would definitely be beyond 
a laymen.


-- 
(¬_    Some days you're the windshield    >o)
//\    Some days you're the bug...        /\\
V_/_                                     _\_V
Charles Bronson

Samba & IPTables

[Dag Wieers]

On Sat, 2 Aug 2003, Charles Bronson wrote:

>  Dag Wieers wrote:
>
>  > Maybe a personal firewall approach is needed. Just like it pop-ups a 
>  > yes/no dialog box for every outgoing or incoming connection such a program 
>  > could pop-up and ask to allow incoming calls for certain listen ports.
>  > (The moment a program listens on a port an event is triggered)
>
>  I will refer back to my point about explaining to laymen first of all what a 
>  "port" is and then what each requested port is used for. 
They don't actually need to know what a port is and certainly not know any 
port numbers. People understand that when they are doing something 
network-related and a pop-up appears, it is related.

And of course the pop-up explains what is going on and if you want to 
allow it temporarily or permanent. And at any time you can go through the 
ruleset and the application explains for each rule what it is about.

It is a great tool to learn more about networking.

 
>  > And then you can decide to allow it from a single address, a
> network 
>  > range or decide to allow it on a case by case basis.
>
>  This dips heavily into understanding the complexities of TCP/IP network addressing.
It doesn't have to. I'm not making this up, this software exists and is 
used already by people that don't fully understand the complexities of 
TCP/IP network adressing.

Zonealarm, Norton Personal Firewall, Symantec Desktop Firewall, 
Firestarter (Linux), ... Sure it's better if they do understand everything 
fully and have a major etc etc. That's not what this thread is about.

 
>  > That's probably what 'Home Users' would expect
> anyway. The current 
>  > iptables firewall from Red Hat is a basic tool and limited in 
>  > functionality.
>
>  This statement is just plain wrong. IPTables is a VERY powerful tool. Are you 
>  maybe referring to the firewall configuration tool? If so it is sufficiently 
>  functional for a home user although using it properly would definitely be beyond 
>  a laymen. 
Lokkit is a very limited tool. It is not functional for most of the home 
users and I don't think it is intended to be. Someone in this thread 
already refered to it (not supporting samba).

--   dag wieers,  dag(a)wieers.com,  http://dag.wieers.com/   --
[Any errors in spelling, tact or fact are transmission errors]

Samba & IPTables

[Charles Bronson]

Dag Wieers wrote:
>  On Sat, 2 Aug 2003, Charles Bronson wrote:
>  
>  
> >Dag Wieers wrote:
> >
> >
> >>Maybe a personal firewall approach is needed. Just like it pop-ups a 
> >>yes/no dialog box for every outgoing or incoming connection such a program 
> >>could pop-up and ask to allow incoming calls for certain listen ports.
> >>(The moment a program listens on a port an event is triggered)
> >
> >I will refer back to my point about explaining to laymen first of all what a 
> >"port" is and then what each requested port is used for.
>  
>  
>  They don't actually need to know what a port is and certainly not know any 
>  port numbers. People understand that when they are doing something 
>  network-related and a pop-up appears, it is related.
>
>  And of course the pop-up explains what is going on and if you want to 
>  allow it temporarily or permanent. And at any time you can go through the 
>  ruleset and the application explains for each rule what it is about.
>  
>  It is a great tool to learn more about networking. 
You are correct when all
networking activities are limited to the Well Known 
Ports. However, what happens when a user gets a request for access to a port 
above 1024? This could be someone trying to hack their pc or it could be a 
legitimate use.

Let's use Bob and Alice (avg users) in an example:
Bob wants to access the faimily computer from work so he installs <insert 
Generic Remote Access Tool name here>. The next day Bob is at work and lights up 
the GRAT client. Alice is home surfing the web and a pop-up asks her if she 
should allow access to port 2029. Pretend your Alice and make the call, what 
would you do?


> >>And then you can decide to allow it from a single address, a
> network 
> >>range or decide to allow it on a case by case basis.
> >
> >This dips heavily into understanding the complexities of TCP/IP network addressing.
>  
>  
>  It doesn't have to. I'm not making this up, this software exists and is 
>  used already by people that don't fully understand the complexities of 
>  TCP/IP network adressing.
>  
>  Zonealarm, Norton Personal Firewall, Symantec Desktop Firewall, 
>  Firestarter (Linux), ... Sure it's better if they do understand everything 
>  fully and have a major etc etc. That's not what this thread is about. 
I have a working lnowledge of some of these tools and will take your word for it 
on the others. Back to my example. Alice is sitting there with this pop-up. 
Assuming she accepted the connection request. Let's assume further that Bob's 
company uses dynamic NAT for their Internet connection. Does Alice or Bob have 
the knowledge to go out to ARIN.net and find out the network address range of 
Bob's corporate network or will she wait by the computer to allow access for 
each previously unused address every time he wants to connect?


>  
>  Lokkit is a very limited tool. It is not functional for most of the home 
>  users and I don't think it is intended to be. Someone in this thread 
>  already refered to it (not supporting samba). 
If you look at my previous reply you
will see that I already agree with you on 
this point.

* In the above example feel free to swap out a random ISP for Bob's company.


-- 
(¬_    Some days you're the windshield    >o)
//\    Some days you're the bug...        /\\
V_/_                                     _\_V
Charles Bronson