[Samba] nobody owned smbd processes are not ending

[Mike McCandless]

I am running the latest release of Samba on RH8 (2.2.7-5.8.0). I use it
primarily to provide master browse functionality, and to act as a print
server (using CUPS 1.1.17-0.2).

I am watching a TOP session, after printing from a W2K workstation.  (I
restarted Samba before I did this).  There is now one smbd processed
owned by nobody, which is not ending (and the print has completed).  In
my smb.conf file, in the Global section, I have:

guest ok = yes
map to guest = Bad User
guest account = nobody

which is where I suspect the nobody processes are coming from.

I have implemented iptables-based firewall rules for the Samba server,
and am seeing the following in /var/log/messages, I believe after the
print occurs.
Apr 11 18:18:01 micky kernel:  IN-DROP IN=eth0 OUT=
MAC=00:c0:4f:4f:5f:30:00:04:5a:71:46:62:08:00 SRC=192.168.1.102
DST=192.168.1.104 LEN=60 TOS=0x00 PREC=0x00 TTL=32 ID=34870 PROTO=ICMP
TYPE=8 CODE=0 ID=768 SEQ=7424
Apr 11 18:18:04 micky kernel:  IN-DROP IN=eth0 OUT=
MAC=00:c0:4f:4f:5f:30:00:04:5a:71:46:62:08:00 SRC=192.168.1.102
DST=192.168.1.104 LEN=60 TOS=0x00 PREC=0x00 TTL=32 ID=34892 PROTO=ICMP
TYPE=8 CODE=0 ID=768 SEQ=7680

(Obviously, I'm blocking any ICMP messages to the Samba server).

Any suggestions about what is cauing this would be very much
appreciated, as well as what tools/techniques to use for investigation.

--------------------------------------------------------
Mike McCandless
michael at prismbiz.com
Red Hat Linux Certified Technician