alfresco and iptables

[Craig White]

On Sun, 2007-12-09 at 17:55 +0000, Jonathan Underwood wrote:
> On 09/12/2007, Craig White <craigwhite at azapple.com> wrote:
> > Well, it's really an iptables question.
> >
> > alfresco runs on tomcat which runs as an unprivileged user which makes
> > it difficult to use as a CIFS server (massive understatement)
> >
> > so what I want to do is to redirect packets from unprivileged ports to
> > the normal SMB ports...here is my iptables script (but it's not working
> > as intended)
> >
> > #!/bin/sh
> > #
> > echo 1 > /proc/sys/net/ipv4/ip_forward
> > modprobe iptable_nat
> > iptables -F
> > iptables -t nat -F
> > iptables -P INPUT ACCEPT
> > iptables -P FORWARD ACCEPT
> > iptables -P OUTPUT ACCEPT
> > iptables -t nat -A PREROUTING -p tcp -d 192.168.3.8 --dport 445 -j
> > REDIRECT \
> > --to-ports 1445
> > iptables -t nat -A PREROUTING -p tcp -d 192.168.3.8 --dport 139 -j
> > REDIRECT \
> > --to-ports 1139
> > iptables -t nat -A PREROUTING -p udp -d 192.168.3.8 --dport 137 -j
> > REDIRECT \
> > --to-ports 1137
> > iptables -t nat -A PREROUTING -p udp -d 192.168.3.8 --dport 138 -j
> > REDIRECT \
> > --to-ports 1138
> > iptables -t nat -A PREROUTING -p tcp -s 192.168.3.8 --dport 1445 -j
> > REDIRECT \
> > --to-ports 445
> > iptables -t nat -A PREROUTING -p tcp -s 192.168.3.8 --dport 1139 -j
> > REDIRECT \
> > --to-ports 139
> > iptables -t nat -A PREROUTING -p udp -s 192.168.3.8 --dport 1137 -j
> > REDIRECT \
> > --to-ports 137
> > iptables -t nat -A PREROUTING -p udp -s 192.168.3.8 --dport 1138 -j
> > REDIRECT \
> > --to-ports 138
> 
> Umm... aren't those last four rules undoin gwhat the first 4 are doing?
----
could be...I didn't think so. Testing was easy enough, in fact, that's
where I started...

#!/bin/sh
#
echo 1 > /proc/sys/net/ipv4/ip_forward
modprobe iptable_nat
iptables -F
iptables -t nat -F
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -t nat -A PREROUTING -p tcp -d 192.168.3.8 --dport 445 \
-j REDIRECT --to-ports 1445
iptables -t nat -A PREROUTING -p tcp -d 192.168.3.8 --dport 139 \
-j REDIRECT --to-ports 1139
iptables -t nat -A PREROUTING -p udp -d 192.168.3.8 --dport 137 \
-j REDIRECT --to-ports 1137
iptables -t nat -A PREROUTING -p udp -d 192.168.3.8 --dport 138 \
-j REDIRECT --to-ports 1138

# smbclient -L 192.168.3.8
Error connecting to 192.168.3.8 (Connection refused)
Connection to 192.168.3.8 failed

# smbclient -L 192.168.3.8 -p 139
Error connecting to 192.168.3.8 (Connection refused)
Connection to 192.168.3.8 failed

# smbclient -L 192.168.3.8 -p 1139
Password:
Anonymous login successful
Domain=[TH] OS=[Java] Server=[Alfresco CIFS Server 3.5.1]

        Sharename       Type      Comment
        ---------       ----      -------
cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe \srvsvc failed with
error NT_STATUS_BUFFER_TOO_SMALL
        Alfresco        Disk
        IPC$            IPC
Error connecting to 192.168.3.8 (Connection refused)
Connection to 192.168.3.8 failed
NetBIOS over TCP disabled -- no workgroup available

Same results either way...

;-)