How can I restrict FTP and SMB access to computers on the internal network - linux

I have Installed samba and tried adding this line config file for samba
Listen=yes
Listen_address= 127.0.0.1
I have also put this in vsftpd.cnf
It doesn't work

The IP addresses 127.x.x.x are always restricted to the local host only, so when other computers try that they connect only to themselves. Assuming you have Linux on a Raspberry Pi, see what other IP addresses it has that connect with the outside world like this:
/sbin/ifconfig
and then use one of those addresses instead. Also try to ping the address from your other computers - if that doesn't work then ftp has little chance of working either.
The vsftpd.conf documentation suggests that the default is to listen on all local addresses. You could try that by commenting out the listen_address line with a # at the start of the line, and then restart the vsftpd server process.
Do not confuse samba and vsftp. They are two separate server processes that use different protocols, port numbers and configuration files.
Beware of case sensitive options, the wrong case will not work. You wrote Listen but probably meant listen ;-)

Related

getting hostname of remote computers on the local network not setup in /etc/hosts

I have a new learning, I was trying to get hostname using python's socket.
so from my macbook I ran the below code:
socket.gethostbyaddr("192.168.1.111")
and I get the ('rock64', [], ['192.168.1.111']) then I tried IP address of a computer that is not on the network anymore but used to be:
socket.gethostbyaddr("192.168.1.189")
and it returned: ('mint', [], ['192.168.1.189']) then I realised its coming from the /etc/hosts file.
now in that host file I also have this entry:
/etc/hosts
172.217.25.3 google.com.hk
but if I try to get host from ip of wan address i get different results than expected!
socket.gethostbyaddr("172.217.25.3")
that returns ('hkg07s24-in-f3.1e100.net', ['3.25.217.172.in-addr.arpa'], ['172.217.25.3'])
so I am not wondering where in the later case of WAN ip address I am getting the hostname and why in case of local computer IP's I am getting hostname from the configured /etc/hosts file ?
How can we get hostname of host computers on the local network without socket.gethostbyaddr having to look into /etc/hosts file or by other means ?
This is opinion based answer to the question "how to build registry of network devices on your local network?"
The best way to build registry of devices on your local network is to setup ntopng on your gateway. It uses DPI (Deep Packet Inspection) Technics to collect information about hosts.
NTOPNG has nice user interface and displays host names (when possible).
You can assign aliases for specific hosts which do not leak host names via any protocol.
For some reasons ntopng developers did not include alias into json response for request http://YOUR-SERVER:3000/lua/host_get_json.lua?ifid=2&host=IP-OF-DEVICE .
You can add it manually by adding lines require "mac_utils" and hj["alias"]=getDeviceName(hj["mac_address"]) into file /usr/share/ntopng/scripts/lua/host_get_json.lua
You can use REST API to interrogate ntopng and use provided information for building any script you need.

Identify different hosts which are the same environment login by ssh

I ssh another host, i know i can ifconfig to realize not the localhost. I want a simple and clear way. Such as change the color of PS1 or something else. It's the remote server.
and now it's my local server.
Is there anyideas?
Theoritically you can make two pcs exactly same in environment. They can have same hostname, OS, applications etc. So the only way to differentiate two PCs on a network is by IP address.
To assign IP address, DHCP protocol uses MAC address which as supposed to be globally unique. So to be completely sure, you have to check IP address or MAC address to differentiate between PCs.
But practically, checking hostname will also work.
~$ hostname
ubuntu-laptop

SSH Works For Some Hosts, Not For Others

I've been having problems SSHing into my work computer from home. I have been able to succesfully ssh into one of our web servers so I know the ssh daemon is working and my connection is at least allowing some ssh. But when I try to ssh to my work computer it times out.
I went to my University yesterday and I was able to succesfully ssh into both the web server and my work computer. I've looked into our firewall at work to see if there are any blocks on my IP but it isn't blocked.
My ISP is comcast if that helps at all. I've done a few google searches and some comcast customers say that comcast sometimes blocks file sharing ports such as the ssh port (22).
Any help would be appreciated. Thanks.
First check the /etc/hosts.deny file of your work computer. That may contain lines which might suggests that certain IP may be blocked. Then check /etc/hosts.allow file. You can add your home-computers outgoing IP to your work computers /etc/hosts.allow.
NOTE: This question should belong to superusers or serverfault. stackoverflow is for questions that involves coding...
There is not one single "ssh daemon"... there is one running on each host to which you connect successfully. If you cannot connect to a host there are two primary reasons:
There is no SSH daemon running on the host. In that case you will likely get "connection refused"
There is a firewall between you and the host, and it is not allowing port 22 to pass through. In that case you will likely get timeouts.
If you are trying to connect to a host behind a firewall from "outside", as you suggest, it is extremely likely that host is not reachable from the Internet. If the IP address of the "work computer" looks like 192.168.x.x or 172.[16-31].x.x or 10.x.x.x then it is an unroutable private address and you will not be able to reach it from the outside no matter what you do unless a specific port-forwarding rule is set up on the firewall; in that case you would be connecting to the firewall's IP address, not your target host.

Troubles accessing the VirtualHost on a local net

Hi I have a Huawei ADSL modem with a dynamic IP. I set up a dynamic dns with freedns and I can easily access my Virtual host on apache from outside my private network, from internet.
So trying to access it from a local network I get a modems login page.
I have the rule in my modems NAT to connect port 80 to my server but it seems it doesnt work from internal net.
My server hosting the virtual host is 192.168.0.1 , the modem has the 192.168.0.254 address.
I tried to put my external domain name into the /etc/hosts file, but if I do that then asterisk server gets confused.
What could be the cause of the problem ? And what would be the best solution to this problem ?
Should I set up a caching DNS on the private side of the net ?
Hugger is half right... Its because your router is blocking loopbacks. The easiest way around this is to edit the hosts file (See the Wiki page) on the computer that is behind the network to see the local IP of the computer as the virtual host your going for. For example if your server is on 192.168.0.1 and the virtual hostname is www.imrad.com then insert
192.168.0.1 www.imrad.com
into your hosts file. If your computer leaves the local network (like a laptop you take to work) and joins a network not behind your router you need to comment out the line in the hosts file.
well actually to access that you must find the local ip address of the server by going into command line/prompt and typing ipconfig /all then you will find ipv4 address. Take note of that.
Go to another computer and your that ip and it will show.
The reason that was happening is because the router/modem knows you are in its network so it will think you ar trying to go top the login page of it. That happens to me too.

xampp server (How to get up and running)

I've been developing locally on a little ubuntu netbook with xampp for about 7 months. Two weeks ago I got a computer I'd like to use as a server. I've installed the latest Ubuntu distribution and xampp, moved all my files over, and forwarded port 80. I've also got a domain name from dyndns.com which is being updated by a client which runs in my router (a Netgear WGR6154 v8).
Now, when I try to access my server by typing in the address I got from dyndns.com the browser loads until it timesout. I can access everything locally using localhost as the address so I believe xampp is running, just unable to connect with the internet.
In order to be able to view my files over the internet what should I do next?
Thanks to all in advance...
[I'm starting a bounty for the first person to help me get my files successfully online]
You have a combination of issues here, and that is something of a problem. Each issue is complex in an of itself. Here is what I would recommend to get you going for certain.
First verify that you can surf the web from your server. This will confirm that you have a working ethernet interface.
Step 1 make sure that XAMPP, and your files are viewable from your home network. I assume you are using something like 192.168.1.X for your network and perhaps your server is 192.168.1.10
Go to another computer in your house and type http://192.168.1.10/ and see if you can see your files. If you can then you know that the server is properly configured and XAMPP is working.
Then add an entry to your hosts file to resolve yourdnsrecord.com (or whatever your dyndns record is) to your private ip address. Then when you type yourdnsrecord.com into a browser from that computer you should still get your files. This will rule out your server being improperly configured to listen for that domain name.
Next you need to test to see if there is a firewall problem. To simplify this, first remove your home router from the equation. Instead, place your new server directly onto your internet connection. (assuming you can). This way, you do not need to have NAT or firewalls properly configured. Your dyndns name should map to a public IP and your server should then have that IP and be connected directly to the Internet. If you have your server directly connected, and the command ifconfig from the root prompt returns the same public IP address that your dynamic dns record is point to, then it should work.
It will make your life easier if you have an iphone or some other way to test how your network is seen from the Internet.
If your public IP as shown by ifconfig is different than the IP record in your dyndns account, then your dynamic dns update script is broken. manually set the IP, and see if things work.
It is very possible that this will not work. Some ISPs firewall port 80 preventing their subscribers from hosting servers. Once you have your server directly connected to the internet you can test this (even if your dns is not working) by using the public IP address. As root, type ifconfig from the command prompt to get your public ip address. Then type the command tcpdump -i eth? port 80 from the root prompt. eth? needs to be the same interface that you saw had a public IP address from the ifconfig command. usually this is eth0 but it might be wire0 or something like that.
This command will show you all traffic coming on port 80 to your server.
From an iphone (or whatever second Internet connection you have) browse to the IP address that you got from your ifconfig command. If you see something on your server (and it is directly connected to your ISP) then your ISP is not firewalling you.
If you can get to your server, when it is directly connected to the Internet, either by IP address or by DynDNS address, then your ISP is OK and it is time to debug your firewall.
Two things need to work for your firewall to be configured NAT, where the public address that your router gets from your ISP is converted into your private network and a firewall rule which permits that traffic. If you get this far, then you know your firewall is the problem and then it is just a matter of getting its configuration correct. There are far to many home routers to document here, but you usually can find how-to instructions for your router for this task from the manufacturers website (usually it is part of the manual)
If you follow these instructions exactly you will get your system working. Make comments on the process and I will be happy to modify this to make it clearer.
HTH,
-FT
You should make sure your xampp is not listening to only the localhost.
to do so edit your apache configuration file and check and search for Listen directive
you should be able to know also by analysing the output of netstat -a.
After that make sure your router is forwarding properly, using tcpdump would help.
drop me a comment if you need more help.
Cheers

Resources