11.4 new install, how to operate Firewall?

On Thu May 26 2011 08:02 pm, PV wrote:

<snip>
TWO OOPS
<snip>
>


> local master = Yes
> *preferred* master = yes
> os level = 65
> 

>
> On ll.4 it is quite difficult to fully disable Apparmor go to
>


P. V.
“We’re all in this together, I’m pulling for you.” Red Green

I am making good progress here. I wish that I could change the name of the thread since my focus has shifted somewhat.

venzkep - thank you for the Swerda reference. Per his advice, I have the SUSE firewalls turned OFF until I have the Samba working properly.

I am now at the point that I can see the “User’s Roaming Shares” on BOTH the 11.3 and the 11.4 machines from all the Windows machines - read and write access which is GREAT!

However, I cannot get the same thing to work between the two Linux machines. Where Swerda gives the advice:

On the linux client you do not initially see the share as an icon as you sometimes do in Windows. Instead you always address the share in your browser by its netBIOS name; e.g. smb://dell112/linux_username.

My browser is of course Firefox. When I try to access the 11.4 machine from Firefox on the 11.3 I type “smb://linux-11-4/george” in the address line. Firefox thinks for a minute, says “loading” and then “done” but nothing comes up in the browser, just a blank screen. It does not ask me for my Samba password.

When I try to access the 11.3 machine from the 11.4, I type “smb://linux-11-3/george” in the Firefox address line but something different happens: a “launch application” dialog comes up telling me that this link needs to be opened with an application that I should choose. Again no Samba password request.

Any idea what is going on here? Thank you!

On Fri May 27 2011 10:36 am, georgeinacton wrote:

>
> I am making good progress here. I wish that I could change the name of
> the thread since my focus has shifted somewhat.
>
> venzkep - thank you for the Swerda reference. Per his advice, I have
> the SUSE firewalls turned OFF until I have the Samba working properly.
>
> I AM NOW AT THE POINT THAT I CAN SEE THE “USER’S ROAMING SHARES” ON
> BOTH THE 11.3 AND THE 11.4 MACHINES FROM ALL THE WINDOWS MACHINES - READ
> AND WRITE ACCESS WHICH IS GREAT!
>
> However, I cannot get the same thing to work between the two Linux
> machines. Where Swerda gives the advice:
>
> On the linux client you do not initially see the share as an icon as
> you sometimes do in Windows. Instead you always address the share in
> your browser by its netBIOS name; e.g. smb://dell112/linux_username.
>
> My browser is of course Firefox. When I try to access the 11.4 machine
> from Firefox on the 11.3 I type “smb://linux-11-4/george” in the address
> line. Firefox thinks for a minute, says “loading” and then “done” but
> nothing comes up in the browser, just a blank screen. It does not ask me
> for my Samba password.
>
> When I try to access the 11.3 machine from the 11.4, I type
> “smb://linux-11-3/george” in the Firefox address line but something
> different happens: a “launch application” dialog comes up telling me
> that this link needs to be opened with an application that I should
> choose. Again no Samba password request.
>
> Any idea what is going on here? Thank you!
>
georgeinaction;

  1. Have you created the user george on both machines with:

sudo smbpasswd -a george

You generally only need the password at most the first time and then it’s
cached. (Not sure with FF I normally use Konqueror or Dolphin.)

  1. Have you tried a different browser?

  2. What do you see if you just enter:


smb://<your_workgroup_name>/

  1. If none of the above help, please post the contents of /etc/samba/smb.conf
    from both machines. Post both the [global] section and the [homes] section.


P. V.
“We’re all in this together, I’m pulling for you.” Red Green

venskep -

  1. Have you created the user george on both machines - Yes and login is correct from the Windows machines

  2. Have you tried a different browser? - Konqueror from 11.4, trying to access 11.3, dialog box asks for username and pw and keeps asking for username and pw, if the dialog is cancelled, “Access Denied” fills the browser. Konqueror from 11.3, trying to access 11.4, does not ask for username and pw - imediately “Access Denied” fills the browser. So at least it is different from Firefox, but not successful. As I said, the username and pw are succesfull from Windows to EITHER of the two Linux machines.

  3. What do you see if you just enter: smb://<your_workgroup_name>/ -

From 11.4 Firefox: wants me to pick and application - no success. No username or pw is requested.
From 11.4 Konqueror: I see drive icons and I can drill down into 11.3/public and see files that I have there and RW ablity !! I also have access to the Window machines’ files read but not write.Looking at 11.4 from 11.4 using smb I have no access to itself.

From 11.3 Firefox: I see the names of the machines at least, in an FTP type display, but if I pick one, I get a dialog box asking me to pick an application. No username pw is requested.
From 11.3 Konqueror: Looking at 11.4 initially I got Access Denied but tried again and got the repeating dialog box - username and pw but no access. Looking at 11.3 from 11.3 through smb I have access to itself.

contents of /etc/samba/smb.conf - I don’t know how to do those nifty “code” boxes that you do but here are the contents:

11.4:

[global]
workgroup = FFWD
netbios name = linux-11-4
name resolve order = bcast host lmhosts wins
passdb backend = tdbsam
printing = cups
printcap name = cups
printcap cache time = 750
cups options = raw
map to guest = Bad User
include = /etc/samba/dhcp.conf
logon path = \%L\profiles.msprofile
logon home = \%L%U.9xprofile
logon drive = P:
usershare allow guests = No
add machine script = /usr/sbin/useradd -c Machine -d /var/lib/nobody -s /bin/false %m$
domain logons = No
domain master = No
security = domain
usershare max shares = 100
wins support = Yes
[homes]
comment = Home Directories
valid users = %S, %D%w%S
browseable = No
read only = No
inherit acls = Yes

I will need to go onto the 11.3 machine and will post the appropriate sections from it in the next message

contents of /etc/samba/smb.conf from 11.3:

[global]
workgroup = FFWD
netbios name = linux-11-3
name resolve order = bcast host lmhosts wins
printcap name = cups
cups options = raw
map to guest = Bad User
include = /etc/samba/dhcp.conf
logon path = \%L\profiles.msprofile
logon home = \%L%U.9xprofile
logon drive = P:
security = domain
usershare max shares = 100
add machine script = /usr/sbin/useradd -c Machine -d /var/lib/nobody -s /bin/false %m$
domain logons = No
domain master = No
passdb backend = smbpasswd
wins support = Yes
usershare allow guests = No

[homes]
comment = Home Directories
valid users = %S, %D%w%S
browseable = No
read only = No
inherit acls = Yes

Thanks for your help!

On Fri May 27 2011 05:06 pm, georgeinacton wrote:

>
> contents of /etc/samba/smb.conf from 11.3:
>
> [global]
> workgroup = FFWD
> netbios name = linux-11-3
> name resolve order = bcast host lmhosts wins
> printcap name = cups
> cups options = raw
> map to guest = Bad User
> include = /etc/samba/dhcp.conf
> logon path = \%L\profiles.msprofile
> logon home = \%L%U.9xprofile
> logon drive = P:
> security = domain
> usershare max shares = 100
> add machine script = /usr/sbin/useradd -c Machine -d /var/lib/nobody
> -s /bin/false %m$
> domain logons = No
> domain master = No
> passdb backend = smbpasswd
> wins support = Yes
> usershare allow guests = No
>
> [homes]
> comment = Home Directories
> valid users = %S, %D%w%S
> browseable = No
> read only = No
> inherit acls = Yes
>
> Thanks for your help!
>
>

georgeinaction;

Do not use “security = domain”. This is only used for a member server of an
NT or Samba Domain, the use in any other situation leads to unpredictable
errors. This setup does not a appear to be a domain unless you have yet
another machine configured as a PDC. “wins support = yes” should never be
set on two machines. I recommend you loss all of that.

Try this for your global sections:


[global]
workgroup = FFWD
netbios name = linux-11-4
name resolve order = bcast host lmhosts wins
printing = cups
printcap name = cups
printcap cache time = 750
cups options = raw
map to guest = Bad User
usershare allow guests = No
usershare max shares = 100

and on 11.3

[global]
workgroup = FFWD
netbios name = linux-11-3
name resolve order = bcast host lmhosts wins
printcap name = cups
cups options = raw
map to guest = Bad User
usershare max shares = 100
usershare allow guests = No
preferred master = Yes
domain master = Yes

The parameters I removed are (or at least should be) at their default values
or are completely unnecessary and unused in a workgroup. If you really want
a wins server please post back and I’ll help with that, but as long as you
are on a single subnet broadcasts work just fine as they do for Windows. Your
[homes] section looks just fine on both machines. After you make these
changes if things are still not working well please post the results of:


sudo pdbedit -L

for both machines.
If you want to see the full list of parameters set for samba execute:


testparm -vs

I use nntp but from the web interface use “code tags” see:

http://forums.opensuse.org/english/get-technical-help-here/how-faq-forums/advanced-how-faq-read-only/451526-posting-code-tags-guide.html

P. V.
“We’re all in this together, I’m pulling for you.” Red Green

and on 11.3

[global]
workgroup = FFWD
netbios name = linux-11-3
name resolve order = bcast host lmhosts wins
printcap name = cups
cups options = raw
map to guest = Bad User
usershare max shares = 100
usershare allow guests = No
preferred master = Yes
domain master = Yes

Looks good and I will try it now. I am curious if I can/should make the 11.4 machine the preferred master and the domain master?
I am preparing the 11.4 machine to be my main linux machine and the 11.3 will eventually disappear.

On Sat May 28 2011 07:06 am, georgeinacton wrote:

>
> and on 11.3
>
> [global]
<snip>
> preferred master = Yes
> domain master = Yes
>
> Looks good and I will try it now. I am curious if I can/should make the
> 11.4 machine the preferred master and the domain master?
> I am preparing the 11.4 machine to be my main linux machine and the
> 11.3 will eventually disappear.
georgeinaction;

Go ahead and make the switch. It would likely be best is 11.4 is to be your
main machine


P. V.
“We’re all in this together, I’m pulling for you.” Red Green