CentOS - Feb 2008 - Security help desperately needed

I need to have the following services from my server:

imap - mostly by lan, but occasionally external
file and print serve
samba access - read and write to some directories

The problems I'm seeing are inconsistent, making it difficult to know how to
find the source.  Samba access is essential to me.  I use a server-based 
korganizer, and without samba it's inaccessible.  Sometimes it is working, 
sometimes it isn't.  Last night, in desperation, I turned off selinux and
the
firewall so that I could finish a job, intending to get it sorted this 
morning.  (There is a router firewall, so while security was diminished it 
was not totally absent.)  This morning my laptop cannot make any samba 
connections at all.

In an attempt to find out what's happening I have searched log files, and
the
only relevant entries are as follow:

messages
#borg2=server - no other connection at this point
Feb  7 10:01:07 borg2 smbd[7393]: [2008/02/07 10:01:07, 0] 
lib/util_sock.c:read_data(534) 
Feb  7 10:01:07 borg2 smbd[7393]:   read_data: read failure for 4 bytes to 
client 192.168.0.91. Error = No route to host 
Feb  7 10:03:09 borg2 smbd[7394]: [2008/02/07 10:03:09, 0] 
lib/util_sock.c:read_data(534) 
Feb  7 10:03:09 borg2 smbd[7394]:   read_data: read failure for 4 bytes to 
client 192.168.0.91. Error = No route to host 
# laptop started - should automount borg2
Feb  7 10:09:48 borg2 automount[2590]: create_udp_client: hostname lookup 
failed: No such process
Feb  7 10:09:48 borg2 automount[2590]: create_tcp_client: hostname lookup 
failed: No such process
Feb  7 10:09:48 borg2 automount[2590]: lookup_mount: exports lookup failed 
for .directory
# last entry refers to nfs export?
# hostname lookup should be by way of /etc/hosts, which holds list of all lan 
members

secure
shows nothing helpful

Way back I remember that msec used to change security settings overnight.  
Could this be happening?

I feel to be thrashing helplessly.  I need help to find a sensible strategy 
for sorting this, then setting correct security measures.

TIA

Anne

On Thursday 07 February 2008 10:29, Anne Wilson wrote:
> I need to have the following services from my server:
>
> imap - mostly by lan, but occasionally external
> file and print serve
> samba access - read and write to some directories
>
<snip>
>
> I feel to be thrashing helplessly.  I need help to find a sensible strategy
> for sorting this, then setting correct security measures.
>
Logwatch for yesterday shows the following:

 --------------------- Automount Begin ------------------------ 

 
 **Unmatched Entries**
 create_udp_client: hostname lookup failed: No such process: 17 Time(s)
 lookup_mount: exports lookup failed for .directory: 17 Time(s)
 create_tcp_client: hostname lookup failed: No such process: 17 Time(s)
 
 ---------------------- Automount End -------------------------

 --------------------- Mountd Begin ------------------------ 

 
 Exit after catching signal:
    Signal 15: 1 Time(s)
 
 ---------------------- Mountd End -------------------------

 --------------------- samba Begin ------------------------ 

 
 WARNING!!!!!!
 Errors when creating subnets:
    No subnets to listen to. Shutting down. : 1 Time(s)
 
 **Unmatched Entries**
 libsmb/nmblib.c:send_udp(791)  Packet send failed to 192.168.0.255(138) 
ERRNO=Invalid argument : 1 Time(s)
 libsmb/smb_signing.c:srv_check_incoming_message(737)  
srv_check_incoming_message: BAD SIG: seq 2 wanted SMB signature of : 6 
Time(s)
 libsmb/smb_signing.c:srv_check_incoming_message(741)  
srv_check_incoming_message: BAD SIG: seq 2 got SMB signature of : 6 Time(s)
 
 ---------------------- samba End -------------------------

I asked the samba mailing list recently about reports similar to the last 
section, but have had no reply.

Anne