Red Hat Linux 7 Unleashed

Red Hat Linux 7 Unleashed

By William Ball

Using SWAT for Web-Based Samba Configuration

SWAT is a Web-based tool to provide local or remote, password-guarded Samba administration from any browser that can access the server. SWAT is new with Samba 2 and is included in Red Hat 7, which ships with Samba 2.0.7.

CAUTION

Configuring with SWAT will dramatically change your smb.conf file. It will eliminate all comments, eliminate include= and copy= options, eliminate many options already set to the default, and change options to more common synonyms (and in some cases to inverse synonyms, simultaneously reversing the value).

Always back up smb.conf before configuring with SWAT. A SWAT-configured smb.conf file is much shorter, making it more readable. However, the loss of comments and self-documenting default-configured options can make it less readable. If you've tailored your smb.conf for readability and self-documentation, you may want to refrain from using SWAT.

SWAT is a convenience that can improve security by making errors less likely. It dramatically changes smb.conf, however, and it can cause a security breach if not used carefully.

Activating SWAT on Your Server

Red Hat 7 comes with SWAT disabled. To enable it, the disable = yes line in /etc/ xinetd.d/swat must be commented out. Also, depending on the state of your system's name resolution it might not work simply because xinetd cannot resolve localhost to a number. As discussed in Chapter 20, "TCP/IP Network Management," Red Hat 7 uses xinetd instead of the older inetd to start various services.

Start by accessing either localhost or your Samba server's IP address as an http URL from either Netscape or lynx. If you receive an error message saying Unexpected network read error; connection aborted. in lynx, or A network error occurred while netscape was receiving data. (Network Error: Connection reset by peer) Try connecting again, it's likely you're being stopped by security. As a temporary diagnostic, disable host checking by doing the following:

  1. Verify that /etc/services contains the following line. The line should not be commented.
    swat           901/tcp
  2. Comment out the following line in /etc/xinetd.d/swat:
           disable = yes
  3. VERY TEMPORARILY comment out the following line in /etc/xinetd.d/swat:
           only_from = localhost
  4. Find the PID of xinetd using ps ax | grep xinetd.
  5. Send a SIGUSR1 signal to xinetd with the following command:
    
         # kill -s SIGUSR1 PID

This procedure should successfully enable SWAT on a typically installed Red Hat 7 server from absolutely any IP address. Obviously, commenting out the only_from = line is a serious security violation. It's just a temporary diagnostic test. If the URL now asks you for a username and password (lynx first throws an Access without authorization denied--retrying error, then asks for the username and password), that means the problem was host checking. Now it's time to fix it correctly.

The original line was as follows:

only_from = localhost

Unless your system can correctly resolve the name localhost, the preceding line causes the discussed error. To resolve this error, simply uncomment the only from= line and replace localhost with 127.0.0.1. If you want to also access SWAT from machines on your local subnet (in all but the smallest, most trusting organizations that's a bad idea), you can add your subnet. For instance, if your network is 192.168.100, the following line enables access from both localhost and from your subnet:

only_from = 127.0.0.1 192.168.100.0

Notice once again that localhost is specified by number, not name. Notice that the 0 in the second IP address serves as a wildcard indicating it's really a subnet, and allowing access from anyone on that subnet. Note further that the two IP addresses are separated by a space, not a comma.

The next step is to access Samba configuration through SWAT.

Configuring smb.conf from Your Browser Using SWAT

CAUTION

After completing your SWAT work, you must close all browsers on your workstation. All open browsers will "remember" the password, allowing anyone with physical access to your workstation (or server terminal) access to Samba configuration, including password administration.

Additionally, if SWAT is used on a browser at a remote workstation, passwords are sent across the wire as clear text and can be sniffed.

For best security, use SWAT only on the server's terminal, and when done, close all browsers. For best security, configure /etc/xinetd.d/swat to accept queries only from 127.0.0.1.

From your favorite browser (Netscape Navigator, Microsoft Internet Explorer, or lynx) navigate to port 901 of the server's IP address:


   # lynx http://192.168.100.1:901

Or, if you're on the console, it's safer to access it as localhost:


   # lynx http://localhost:901

The browser asks for a username and password. To enable read-write access, use root and root's password. Once authenticated, a page appears with links for HOME, GLOBALS, SHARES, PRINTERS, STATUS, VIEW, and PASSWORD. Choosing GLOBALS, SHARES, or PRINTERS brings up a page in which you can edit options. Each contains a button that can be toggled between Advanced View and Basic View, with Advanced View showing every possible configuration option. Note that with the SHARES and PRINTERS pages, you'll need to choose the share or printer from a drop-down list and then click the Choose button before you can edit the share or printer.

Assuming you're logged in to SWAT as root, a Commit Changes button will be visible. After making changes, clicking this button will write smb.conf. If you click the Reset Values button, the options will revert to values in the present smb.conf file.

NOTE

Some smb.conf changes take effect immediately, but to ensure that all changes take effect, you must restart smbd with the following command:


      # /etc/rc.d/init.d/smb restart

The SWAT page contains voluminous, well-organized documentation, available even to those not logged in as root, and therefore unable to change the configuration.

Share ThisShare This

Informit Network