howto restrict samba access

If you remove the line from hosts.allow, what will happen is that what you configure in hosts.deny will be denied. I think that this is the behavior you expect!
If tcpwrappers cannot find any rule for a certain packet in the two configuration files, it grants permission to the connection. You will not block anything more than what is configured in hosts.deny by doing this.

I currently have 179 different outside IPs that are trying to access this system via samba.  ::


Is this samba server is also a public server ?? Samba runs on port 139 for tcp, udp/137/138

if you can telnet your server to port 139 from Outside of your network that means your server is wide open to outside

can you try to tellnet to samba from outside of your network ??

telnet public-ip 139

see if it connects

or  from inside network from any pc go to this website

http://www.canyouseeme.org

and scan, it will tell you what ports are open

Whoa... if your file server is available to the Internet, then it shouldn't be allowing samba out on the Internet interface at all. Use the interfaces option in your smb.conf file to keep samba from talking on the Internet facing network at all!

Assuming your Internet-facing network card is eth0 and your LAN-facing network card is eth1, you would make the following entry in /etc/samba/smb.conf (or wherever your distribution put the smb.conf file):

--- begin section of smb.conf ---
[global]
interfaces = eth1 lo
bind interfaces only = yes
--- end section of smb.conf ---

You allow the lo interface for loopback (useful in testing samba), and obviously the eth1 interface for your local hosts.

You can also accomplish this with firewall rules, or about 100 other ways (typical *nix systems!)... but this is the easiest & most robust method... IMHO!

Good luck!

Dan
IT4SOHO

PS: If you've got only one interface, then you'll have to use either iptables, or a "hosts allow" in your smb.conf... To specifically allow only specific hosts (IP addresses), use something like this:

--- begin section of smb.conf ---
[global]
hosts allow = 127.0.0.1 192.168.0.0/24
--- end section of smb.conf ---

This will allow only the specified hosts (localhost = 127.0.0.1, and I assumed your LAN would be 192.168.0.0/255.255.255.0)

Finally, since Windows 2000 there has been a "preferred" windows file sharing port of 445... ports 137-139 date from Windows 3.1 & Windows NT and are supported even today up through Windows 7, but Samba & all modern Windows clients will TRY on TCP port 445 first!

Whew....

Dan