Just [invaleed]

This is a note for all those people out there who had to turn off their firewalls (iptables) to get Samba to work.

• Applications – System Setting – Security Level
• Input your root password, than go to “firewall options” tab
• Choose “enable firewall”
• Click the check box for your network adapter (usually “eth0″).
• Click on the checkboxes for any services you want to allow (I allow WWW, FTP, SSH, DHCP, and Telnet).

In the “Other ports” edit box, enter :

137:udp,137:tcp,138:udp,138:tcp,139:udp,139:tcp

• Save the configuration.
• Restart Firewall

[root@invaleed ~]# /etc/init.d/iptables restart
Flushing firewall rules: [ OK ]
Setting chains to policy ACCEPT: filter [ OK ]
Unloading iptables modules: [ OK ]
Applying iptables firewall rules: [ OK ]

Congratulations:)

Secara Default SWAT di configure melalui webl ink yang tidak terencrypt, maka dari itu untuk alasan security, kita bisa malekukan securing dengan menggunakan openssl (https).

langkah-langkahnya adalah :

• Create User stunnel

# useradd stunnel

• Create The Certificates

# cd /usr/share/ssl/certs
# make stunnel.pem
# chmod 640 stunnel.pem
# chgrp stunnel stunnel.pem

• Create /etc/stunnel/stunnel.conf

Sebagai contoh, kita bisa gunakan /etc/stunnel/stunnel.conf seperti ini:

# Configure stunnel to run as user “stunnel” placing temporary
# files in the /home/stunnel/ directory
chroot = /home/stunnel/
pid = /stunnel.pid
setuid = stunnel
setgid = stunnel

# Log all stunnel messages to /var/log/messages
debug = 7
output = /var/log/messages

# Define where the SSL certificates can be found.
client = no
cert = /usr/share/ssl/certs/stunnel.pem
key = /usr/share/ssl/certs/stunnel.pem

# Accept SSL connections on port 901 and funnel it to
# port 902 for swat.
[swat]
accept = 901
connect = 902

• Create file Secure SWAT baru di /etc/xinetd.d

Untuk memudahkan, kita bisa meng-copy dari file SWAT yang asli.

# cd /etc/xinetd.d
# cp swat swat-stunnel
# vi swat-stunnel

Kemudian edit file swat-stunnel menjadi seperti ini:

service swat-stunnel
{
port = 902
socket_type = stream
wait = no
only_from = 127.0.0.1
user = root
server = /usr/sbin/swat
log_on_failure += USERID
disable = no
bind = 127.0.0.1
}

Agar tidak menjadikan conflict maka file swat di /etc/xinetd.d/swat harus di disable, dengan cara mengubah config “disable = no/yes” menjadi “disable = yes”

• Kemudian edit /etc/services

# vi /etc/services

swat-stunnel 902/tcp # Samba Web Administration Tool (Stunnel)

• Actifkan swat-stunnel

# chkconfig swat on
# chkconfig swat-stunnel on

• Start stunnel

# stunnel

• Test Secure SWAT

# netstat -tan | grep 90

tcp 0 0 0.0.0.0:901 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.:902 0.0.0.0:* LISTEN

• Test Secure SWAT Login

Arahkan web browser anda ke https://server-ip-address:901/ jika muncul halaman login, silahkan masukkan username dan password sesuai dengan settingan Anda.

1. Install swat via yum, pastikan terlebih dahulu samba server dan samba client dah terinstall di machine CentOS anda:

# yum install samba-swat

2. Edit super daemon (inetd : di /etc/inetd.conf atau xinetd : di /etc/xinetd.d/swat), kebetulan saya menggunakan xinetd.

# vi /etc/xinetd.d/swat

# default: off
# description: SWAT is the Samba Web Admin Tool. Use swat \
# to configure your Samba server. To use SWAT, \
# connect to port 901 with your favorite web browser.
service swat
{
port = 901
socket_type = stream
wait = no
only_from = localhost
user = root
server = /usr/sbin/swat
log_on_failure += USERID
disable = yes
}

Rubah menjadi :

# default: off
# description: SWAT is the Samba Web Admin Tool. Use swat \
# to configure your Samba server. To use SWAT, \
# connect to port 901 with your favorite web browser.
service swat
{
port = 901
socket_type = stream
wait = no
only_from = localhost
user = root
server = /usr/sbin/swat
log_on_failure += USERID
disable = no
}

Jika anda ingin menggunakan swat ini secara remote, maka caranya adalah dengan menghapus atau meng-comment (#) baris config only_from = localhost atau only_from = 127.0.0.1

3. Silahkan di test menggunakan browser, arahkan ke http://ip_machine_swat:901, good Luck