Installing Samba Vicki Insixiengmay Jonathan Krieger

Samba  "Samba is an Open Source/Free Software suite that provides seamless file and print services to SMB/CIFS clients." Source:  Installed on any other platform than Microsoft Windows  Make use of TCP/IP protocol installed on Host server  Allows Host to interact with Windows Client/Server

Four Samba Elements  File and Print Services  Authentication and Authorization  Name Resolution  Service Announcement (Browsing)

Model Samba Network Source: “Using Samba” by Robert Eckstein, David Collier-Brown, Peter Kelly

What Samba Does  Samba runs on Unix platforms. It speaks to Windows clients.  It allows a Unix system to move into a Windows “Network Neighborhood”.  Windows users can access file and print services.

SMBD  File and print services are provided by smbd, the SMB Daemon.  Handles "share mode" and "user mode" authentication and authorization. You can protect shared file and print services by requiring passwords.  Each user has their own username and password and the System Administrator can grant or deny access.

NMBD  The other two CIFS (Common Internet File System) pieces, name resolution and browsing, are handled by nmbd.  These two services basically involve the management and distribution of lists of NetBIOS (Network Basic Input Output System) names. NetBIOS is software loaded into memory.  Provides an interface between programs and the network hardware.

Name Resolution  Name resolution takes two forms: broadcast and point-to-point.  Client shouts out the name of the service it is looking for and waits for the machine with that name to answer with an IP address.  It is restricted to the local LAN so it doesn't cause too much trouble.

Name Resolution  Point-to-point includes use of an NBNS (NetBIOS Name Service) server  The clients send their NetBIOS names & IP addresses to the NBNS server, which keeps the information in a database.  When a client wants to talk to another client, it sends the other client's name to the NBNS server. If the name is on the list, the NBNS hands back an IP address.

Service Announcement (Browsing)  Ability to examine the servers and shares available on the network  A browse list keeps a list of current, active servers. This is stored on one machine in a network.  A local master browser updates the information in the browse list as computers sign on and off. This can be any server on the network.

smb.conf file  [global]  [home]  [printers]  Each section describes the accessibility for users

SWAT  SWAT  Samba Web Administration Tool  Locates parameters supported by Samba  Always up to date as Samba parameters change  Provides context-sensitive help for each configuration parameter  Stores only parameters settings other than defaults  Port 901  Uses ISS RealSecure

Installing Samba  Downloaded latest version from samba.org  Configured /etc/xinted.conf Enable SWAT service SWAT   Configured smb.conf Add IP addresses of Windows machines Password server – lab2.research.cs.uofs.edu

Problems  Windows machine recognizes Samba server, but does not allow access.  Solution: Different encryption/decryption systems for Windows and Unix. Find enableplaintextpassword and disenable Windows encryption.

Adding Samba Users  Each user must be added adduser –g 100 plishka  Create passwords for user passwd plishka  Create Samba domain login passwords In /usr/bin smbpasswd –a plishka

References   les/Samba.html les/Samba.html  hn/samba.htm#_Toc hn/samba.htm#_Toc  r/book/

Browsing Elections  A computer becomes a local master browser by holding a browsing election.  Samba can rig a browsing election for a variety of outcomes,including always becoming the local master browser of the subnet or never becoming it.  In smb.conf, [global] #Browsing election options os level = 34 local master = yes

Browsing Elections  Each machine in the election broadcasts information. Version of election protocol Operating system Amount of time client has been signed on Host name of client

Browsing Elections  How elections are decided Operating system is assigned a binary value according to version Each computer is assigned a value according to its role The machine with the highest election protocol version wins OR The machine with the highest operating system values In case of tie, machine with setting of preferred master browser wins OR client signed on the longest wins OR client name that comes first alphabetically wins

ISS RealSecure  RealSecure provides an intrusion detection system that monitors suspicious behavior, making changes to the system in real time, such as terminating sessions or changing the firewall  The current versions of RealSecure Network Sensor include the ability to decode SAMBA/CIFS protocols for Windows networking.  Comprised of Network Sensor, OS Sensor, and Console

ISS RealSecure  Network Sensors work by comparing the traffic on the network against a set of rules defined in a number of policies.  OS Sensors runs as a process on the server that is being monitored. Every time a new log-file entry is generated by the operating system, OS Sensor reads it, and compares it against the signatures currently in force. If a match is found, it initiates the appropriate response. OS Sensor is able to detect local attacks and abuses that would normally be missed by the Network Sensor.  Console and the Sensors communicate with each other. The console defines the policy for each sensor. Includes: Network Sensor security events connection events, OS Sensor security events

Synchronization of Usernames and Passwords  The Unix password sync global option allows Samba to update Unix password file when user changes his/her password. The password is stored on a Samba server in the smbpasswd file, located in / usr/local/samba/private by default.  [global] unix password sync = yes  Samba changes the encrypted password and attempts to change the standard Unix password by passing the username and new password to the program specified by the passwd program option.

Synchronization of Usernames and Passwords  Samba does not necessarily have access to the plaintext password for the user, so the password changing program must be invoked as root.