[7.951][BUG][OPEN] Samba Problem over 2 Firewalls

Hi There,

i have a problem with Samba and SSL VPN.

When i connect 2 Astaro Firewalls with SSL VPN, i can run samba like a charm. But if i make a "star connection" Network1 - > Astaro -> Central Astaro -> Astaro -> Network 2 (to connect more than 2 networks in a star configuration) i'm not able to use Samba anymore ...

I can see folders, change into them, see files, but i can't copy, move oder modify files, i get every time an Windows errormessage which says "file not available anymore"

If i connect back 2 firewalls directly : Network1 -> astaro -> astaro -> network 2, it works again ...

Anyone any idea?

Regards Robert

0 Astaro Beta Bot over 13 years ago

Astaro Beta Report
--------------------------------
Version: 7.951
Type: BUG
State: NEW/OPEN
Reporter: Robert Tausend
Contributor: 
MantisID: 14355
Target version: 8.050
Fixed in version: 
--------------------------------

0 UrsWeiss over 13 years ago in reply to Astaro Beta Bot

Can you try to turn of IPS (if enabled), or watch the IPS logs while accessing files?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Robert Tausend over 13 years ago

Hmmm, verry stange, i could copy 2 files, then i had again the failure ... following entry i found:

2010:06:29-08:45:12 firewall snort[6102]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="NETBIOS SMB client TRANS response ring0 remote code execution attempt" group="110" srcip="192.168.111.3" dstip="172.28.10.21" proto="6" srcport="445" dstport="54417" sid="16531" class="Attempted Administrator Privilege Gain" priority="1" generator="3" msgid="0"

Found on the "middle" firewall ...
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Robert Tausend over 13 years ago in reply to UrsWeiss

and again one entry on the "network2" firewall:

2010:06:29-08:51:17 firewall snort[5554]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="" reason="(dcerpc2) SMB - Bad NetBIOS Session Service session type" group="0" srcip="192.168.111.3" dstip="172.28.10.21" proto="6" srcport="445" dstport="54476" sid="0" class="Potentially Bad Traffic" priority="2" generator="133" msgid="1"
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 UrsWeiss over 13 years ago in reply to Robert Tausend

Seems that is recognizes the middle firewall as a man-in-the-middle:

SnortID.com - Search for SNORT ID's - Snort is a registered trademark of Sourcefire, Inc

Don't know if there is another workaround than disabling this single (16531) rule in the middle firewall.

The other alert may is a result of the first alert. Try again after disabling the rule above.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Robert Tausend over 13 years ago

will give it a try [:)] lets see
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel