Subject: Re: Problem with Netbios

From: Maria Alandes Pradillo <[email-masked]>
Date: Wed, 01 Mar 2000 10:17:45 +0100

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

> You can't connect to a shared drive unless you permit UDP 138 and TCP 139.
> Name service isn't necessary. You can't plug nbdatagram because it's UDP;

Is there any other application, similar to plug-gw, that could plug UDP? In any
rate, maybe if I use ip forwading I can dothat, but then I cannot use fwtk

> you can't NAT it in an simple packet filter because the prototcol contains
> imbedded IP addresses that must also be translated.
>

The nature of netbios will never allow for this "redirection" even with ip
forwarding, right?

> Opening NetBIOS session service can open you to a dictionary attack,
> leaving your shared directories open to the world.
>          -Rick

So you mean that sharing filesystems with machines in the internet is not a good
idea, right? is there any secure way of doing it?

                Thanks!

--
María Alandes Pradillo

Universidad Politécnica de Madrid (Madrid Technical University)
E.U. Informática. Organización y Estructura de la Información
Ctra. de Valencia, Km. 7. E-28031 Madrid. Spain
T.: (+34)-913367881 Fax. (+34)-913367520
e-mail: [email-masked]

---

From: Nick Colakovic <[email-masked]>
Date: Wed, 1 Mar 2000 10:07:06 -0600

UDP 
>138 and TCP 139.

Udprelay.  It works like plug-gw for UDP.   Depending on what OS you compile
under you will likely need patches to get it to work.  It works alright for
in our use, but it is rough around the edges.   The real issue it has is
that the no one has unified the various patches made for it.

>idea, right? 

Yes.  Opening up the SMB ports exposes the machine in question to a large
number of well documented attacks.   These include DoS attacks, password
dictionary attacks, etc.

>is there any secure way of doing it?
	
Sure setup a IPSEC encrypted tunnel between the two machines.   There are a
few open source products for linux and xBSD that allow a IPSEC tunnel to be
created between two Unix machines.   Natively in WinNT 4.0 and Win 9x IPSEC
is not available.  There are a good number of third party products that
implement IPSEC under WinNT 4.0.   The real issue here is the
interoperability with two different products.   Many times Product A cannot
talk to product B.  Personally I wouldn't bother with the open source stuff
as these have limited throughput  and the implementations seem to be beta
quality at best.   But then I again I haven't used these products so someone
else might have a better opinion of them.   Personally I would use a
hardware VPN box(s) to do this.

	-NRC