Standard Reference Material

O'Reilly SAMBA Book This is a freely distributed book.


Mounting UVA's Home Directory Service

(as root)
mkdir /home/rtg2t/home1
smbmount //home1/rtg2t /home/rtg2t/home1 -o username=rtg2t,ip=home1.virginia.edu

Quick Start Instructions for installing a SAMBA server

Windows XP Workstation Setup


Adding Samba to IPTABLES

Allow ports 137,138, 139 and 445 to cross the firewall for a limited range of IP addresses. 
-A FW-IN -s 128.143.0.0/16 -m state --state NEW -m tcp -p tcp --dport 137 -j ACCEPT
-A FW-IN -s 128.143.0.0/16 -m state --state NEW -m udp -p udp --dport 137 -j ACCEPT
-A FW-IN -s 128.143.0.0/16 -m state --state NEW -m tcp -p tcp --dport 138 -j ACCEPT
-A FW-IN -s 128.143.0.0/16 -m state --state NEW -m udp -p udp --dport 138 -j ACCEPT
-A FW-IN -s 128.143.0.0/16 -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT
-A FW-IN -s 128.143.0.0/16 -m state --state NEW -m udp -p udp --dport 139 -j ACCEPT
-A FW-IN -s 128.143.0.0/16 -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT
-A FW-IN -s 128.143.0.0/16 -m state --state NEW -m udp -p udp --dport 445 -j ACCEPT

Using Nagios to detect and report login failures


1. use level 2 debugging in the samba.conf file.  This turns on the log entry like

check_ntlm_password: Authentication for user [rtg2t] -> [rtg2t] FAILED with error
NT_STATUS_WRONG_PASSWORD

2. Write a crontab daemon that runs every 5-10 minutes that captures these entries to a log
file.  Nagios plugins are limited to how much grepping they can do in a shell
script.

#!/bin/bash
#
# look for large number of failed username attempts
#
#
grep FAILED /var/log/samba/user.log \ 
    grep _STATUS_WRONG_PASSWORD   > /var/log/samba/failed.log

3. Write your Nagios plugin to process this error file
Below are the shell script and a C program that can be compiled
to do the same thing

#!/bin/bash
#
count=`wc  /var/log/samba/failed.log  | cut -c 6-9`
who=`cut -f2 -d[  /var/log/samba/failed.log|sort|cut -f1 -d] | uniq
echo OK - ${count} login errors by ${who} ${whendate}

if [ $count -gt 10 ]
then
   retcode=1
fi

if [ $count -gt  29 ]
then
   date=`date +%Y.%m.%d.%H.%M`
   cp /var/log/samba/user.log /var/log/samba/failed.${date}.txt
   retcode=2
fi
exit ${retcode}
#
#Eof

======================================
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <ctype.h>

#define MAXLINELEN (int)400

int  main( int argc, char *argv[])
{

char instr[MAXLINELEN], *pos1, *pos2, outstr[2000];
int i = 0, retcode=0, warnLevel, critLevel;
FILE *fp;

if (argc < 3)
{
   puts("usage: check_samba_log filename warnLevel CritLevel");
   exit( 3);
}

 warnLevel=atoi( argv[2]);
 critLevel=atoi( argv[3]);


fp = fopen( argv[1],"r");
if (fp == NULL)
{
    printf( "%s %s\n", argv[1], "file not found");
    exit( 1);
}
fgets( instr, 400, fp);


do
{
   if( strlen( instr) > 0)
   {
     pos1 = strstr( instr, "[");
     pos2 = strstr( instr, "]");
   }
   if( pos1 == NULL || pos2 == NULL)
   {
      i = i - 1;
   }
   else
   {
      *pos2 =  '\0';
      strcat( outstr, " ");
      strcat( outstr, pos1+1);
      fgets( instr, 400, fp);
   }
   i++;
} while (feof(fp)== 0);


printf( "OK %s %d\n", outstr, i);
fclose( fp);


if ( i >  warnLevel)
{
  retcode=1;
}

if ( i >  critLevel)
{
 retcode=2;
}

exit( retcode);

}  // main

4. Configure Nagios to email you when it flags a warning (retcode=1).  It
   would be nice if the samba error message included the IP address and the
   MAC address of the miscreant user.

Other Samba info