samba - Sep 2008 - Slow "run as ...", firewall issues.

After doing some system work, including upgrading the Samba server to
3.0.28a from 3.0.24, upgrading the kernel to 2.6.24, and changing the
firewall rulesk, the XP workstations which belong to that domain, the
right click "run as ..." option is slow to bring up a dialog.  The
phenotype is this:

right click some program (for instance, a shortcut to the
  "command prompt")
select "run as ..."
15 seconds elapse before the dialog appears

Once the dialog appears, a local machine account can login more or less
instantaneously, and a domain account can login in about 35-40 seconds.

Oddly, if instead of logging in, the dialog is closed, and then "run
as..." selected again, that dialog appears immediately.  This is also
true if a different application is selected.  Wait one minute though
(about, 30 seconds is not long enough, 45 seconds to 1 minute usually
is) and the next time it will be slow once more.

Working back through this it turned out that the firewall rule which had
previously allowed 137-138 access:

ACCEPT     tcp  --  xxx.xxx.xxx.xxx       yyy.yyy.yyy.yyy       tcp
dpts:137:139 state NEW 
ACCEPT     udp  --  xxx.xxx.xxx.xxx       yyy.yyy.yyy.yyy        udp
dpts:137:139 state NEW 
ACCEPT     tcp  --  xxx.xxx.xxx.xxx       yyy.yyy.yyy.yyy        tcp
dpts:137:139 
ACCEPT     udp  --  xxx.xxx.xxx.xxx       yyy.yyy.yyy.yyy        udp
dpts:137:139 

was no longer being applied.  Logins still worked using 445, the only
issue was the slow "run as...".

So I changed the rules to:

REJECT     tcp  --  xxx.xxx.xxx.xxx       yyy.yyy.yyy.yyy       tcp
dpts:137:139 reject-with icmp-port-unreachable 
REJECT     udp  --  xxx.xxx.xxx.xxx       yyy.yyy.yyy.yyy       udp
dpts:137:139 reject-with icmp-port-unreachable 

And "run as..." was fast again.

So, by trial and error, I have so far learned that for a Samba
machine's firewall to work right

445     must be open

and the following ports must be set to REJECT (or ALLOW, but not DROP)

137-139 (as above)
80      (or there is a long webDAV delay if there is no http server)

Are there any others I should know about???

Thanks,

David Mathog
mathog@caltech.edu
Manager, Sequence Analysis Facility, Biology Division, Caltech

On Wednesday 17 September 2008 06:59:26 pm David Mathog
wrote:
> Are there any others I should know about???
I'm of the opinion that drop is generally a bad idea, especially on your 
internal lan. Maybe useful for known bogon IP's on the net side.

Chris

Update...
> So I changed the rules to:
> 
> REJECT     tcp  --  xxx.xxx.xxx.xxx       yyy.yyy.yyy.yyy       tcp
> dpts:137:139 reject-with icmp-port-unreachable 
> REJECT     udp  --  xxx.xxx.xxx.xxx       yyy.yyy.yyy.yyy       udp
> dpts:137:139 reject-with icmp-port-unreachable 
> 
> And "run as..." was fast again.
Except, after several hours, it was slow again!  I believe there was
some issue with the Samba server retaining netbios names after the
REJECT is set, but then it eventually loses those due to the REJECT.
Once that happens "run as..." is once again slow, even though ports
137-139 are still REJECTing connections from the client machine.
This is a complex interaction, with what appears to be stored values
timing out - because restarting Samba may be needed to fix it (quickly)
even if the server has the firewall shut off. Rather than experimenting
with further firewall rules for the campus Winbind servers (I think) I
gave up and once again set ports 137-139 to ACCEPT for on campus
machines.  Note that that alone did not immediately speed up "run
as...", but a subsequent restart of samba did, and it is still fast 14
hours later.

If one of the Samba developers could explain this messy interaction it
would be greatly appreciated.

Thank you,

David Mathog
mathog@caltech.edu
Manager, Sequence Analysis Facility, Biology Division, Caltech