I am running the latest release of Samba on RH8 (2.2.7-5.8.0). I use it
primarily to provide master browse functionality, and to act as a print
server (using CUPS 1.1.17-0.2).
I am watching a TOP session, after printing from a W2K workstation. (I
restarted Samba before I did this). There is now one smbd processed
owned by nobody, which is not ending (and the print has completed). In
my smb.conf file, in the Global section, I have:
guest ok = yes
map to guest = Bad User
guest account = nobody
which is where I suspect the nobody processes are coming from.
I have implemented iptables-based firewall rules for the Samba server,
and am seeing the following in /var/log/messages, I believe after the
print occurs.
Apr 11 18:18:01 micky kernel: IN-DROP IN=eth0
OUTMAC=00:c0:4f:4f:5f:30:00:04:5a:71:46:62:08:00 SRC=192.168.1.102
DST=192.168.1.104 LEN=60 TOS=0x00 PREC=0x00 TTL=32 ID=34870 PROTO=ICMP
TYPE=8 CODE=0 ID=768 SEQ=7424
Apr 11 18:18:04 micky kernel: IN-DROP IN=eth0
OUTMAC=00:c0:4f:4f:5f:30:00:04:5a:71:46:62:08:00 SRC=192.168.1.102
DST=192.168.1.104 LEN=60 TOS=0x00 PREC=0x00 TTL=32 ID=34892 PROTO=ICMP
TYPE=8 CODE=0 ID=768 SEQ=7680
(Obviously, I'm blocking any ICMP messages to the Samba server).
Any suggestions about what is cauing this would be very much
appreciated, as well as what tools/techniques to use for investigation.
--------------------------------------------------------
Mike McCandless
michael@prismbiz.com
Red Hat Linux Certified Technician
