samba - Feb 2014 - Minimal configuration for Name Service

Hi,

In my company we have a new requirement that say when our device has disks,
it should run smbd and nmbd to serve files and name services (as it always
has been done). However, when all disks are removed, we still need nmbd to
answer its own netbios name - any other name resolution is completely
optional, though.

My question is, regardless or security mode (workgroup/AD), what would be
the minimal smb.conf configuration to provide its own name resolution and
completely turn off file/authentication services ? Is it advisable ? Is
there any security issue that needs to be addressed ?

I've considered all sections but [GLOBALS] as superfluous in this scenario,
so my final smb.conf is:

[global]
available=no
 name resolve order = hosts
wins support = no
wins proxy = no
 dns proxy = no

It seems to work fine (http://<mynetbiosname> redirected to our device
page), but an "official" confirmation would make me less nervous about
this
really odd use case.

-- 
Thiago

Hello Thiago,

Am 26.02.2014 16:16, schrieb Thiago Crepaldi:
> It seems to work fine (http://<mynetbiosname> redirected to our
device
> page), but an "official" confirmation would make me less nervous
about this
> really odd use case.
If you only want to http://servername, you simply have to add that host 
to your DNS server. http does not use netbios. It uses DNS for name 
resolution.



 > My question is, regardless or security mode (workgroup/AD), what
 > would be the minimal smb.conf configuration to provide its own name
 > resolution and completely turn off file/authentication services ?

I think, the most minimal config is:

[global]
workgroup = WKG
netbios name = MYNAME



I know, that this isn't an answer to your question, but why does your 
company want to run services (smb, etc.) on a host, that doesn't serve 
anything through it? It only opens places for attacks if it's not 
updated regularly.

If you want to connect to other services on this host, you don't need 
Samba, as most services use DNS for name resolution.



Regards,
Marc