Paranoid Penguin - Samba Security, Part III

Start creating shares on your secure Samba file server.
Conclusion

That's all we've got space for this month. Next time, we'll create that third, mick-only share (I'll bet you can figure that out yourself beforehand), create persistent Samba mounts on our client systems using smbmount and at least briefly address some miscellaneous Samba security topics, such as how to make Samba automatically and safely serve people's home directories. Until then, be safe!

Mick Bauer (darth.elmo@wiremonkeys.org) is Network Security Architect for one of the US's largest banks. He is the author of the O'Reilly book Linux Server Security, 2nd edition (formerly called Building Secure Servers With Linux), an occasional presenter at information security conferences and composer of the “Network Engineering Polka”.

______________________

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

troubleshooting with smbclient failed

honkytonkwillie's picture

Everything in this series of articles has worked so far until I get to the section in part III with smbtreee and smbclient.

when I enter the command

"smbclient //myserver/share -U nobody" with no password,

I get

Anonymous login successful
Domain=[MYWORKGROUP] OS=[Unix] Server=[Samba 3.0.28a]
tree connect failed: NT_STATUS_ACCESS_DENIED

Same thing happens when I use "totallyfakeusername".

Is there some obvious config thing I missed? Aside from adding users and passwords at manually at the command line, everything else I did using SWAT.

The only other item I can think to mention is that I'm not working on my server directly, but through my network from my main workstation.

Thank you.

Honkytonkwillie

troubleshooting with smbclient failed

EdSol's picture

Took me some time to figure out NT_STATUS_ACCESS_DENIED (Not a very informative thing). I remembered trying this one recently. Might help you too:

http://www.microdevsys.com/WordPress/2009/07/27/networking-sharing-folde...

Good Luck!
EdSol

edit

honkytonkwillie's picture

upon closer inspection, when trying to force a Bad User with "totallyfakeusername", I do not get an "Anonymous login successful" message, and alss the domain is different,
Domain=[MYSERVER] instead of Domain=[MYWORKGROUP]. I still get a "tree connect failed: NT_STATUS_ACCESS_DENIED" error.

Same problem here I

Anonymous's picture

Same problem here

I get
Domain=[FED-CENTRAL] OS=[Unix] Server=[Samba 3.4.0]
tree connect failed: NT_STATUS_BAD_NETWORK_NAME

Please help
Tx

Geek Guide
The DevOps Toolbox

Tools and Technologies for Scale and Reliability
by Linux Journal Editor Bill Childers

Get your free copy today

Sponsored by IBM

Webcast
8 Signs You're Beyond Cron

Scheduling Crontabs With an Enterprise Scheduler
On Demand
Moderated by Linux Journal Contributor Mike Diehl

Sign up and watch now

Sponsored by Skybot