From shawn at redhat.com Thu Aug 20 11:34:07 2015 Content-Type: multipart/mixed; boundary="===============2485454304078093391==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH 3/3] removed some now-obsolete advice from samba Date: Sun, 12 May 2013 23:24:59 -0400 Message-ID: <51905D0B.50307@redhat.com> In-Reply-To: 1368414750-21958-4-git-send-email-blank@eclipse.ncsc.mil --===============2485454304078093391== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 5/12/13 11:12 PM, Jeffrey Blank wrote: > Signed-off-by: Jeffrey Blank > --- > RHEL6/input/services/smb.xml | 134 ++++++++---------------------------= ------- > 1 files changed, 24 insertions(+), 110 deletions(-) > > diff --git a/RHEL6/input/services/smb.xml b/RHEL6/input/services/smb.xml > index 3190439..f211170 100644 > --- a/RHEL6/input/services/smb.xml > +++ b/RHEL6/input/services/smb.xml > @@ -49,115 +49,18 @@ and allow client machines to access local home direc= tories and > printers. It is recommended that these settings be changed or that > additional limitations be set in place. > = > - > - > - > - > - > - > -Disable Root Access > -Administrators should not use administrator accounts to acc= ess > -Samba file and printer shares. Disable the root user and the wheel > -administrator group: > -
[share]
> -  invalid users =3D root @wheel
> -If administrator accounts cannot be disabled, ensure that local machine > -passwords and Samba service passwords do not match.
> - > -Typically, administrator access is required when Samba must create user = and > -machine accounts and shares. Domain member servers and standalone server= s may > -not need administrator access at all. If that is the case, add the inval= id > -users parameter to [global] instead. > - > - > - > -
> = > - > -Disable Root Access > -By default, Samba will attempt to negotiate with Microsoft = Windows > -machines to set a common communication protocol. Newer versions of Micr= osoft > -Windows may require the use of NTLMv2. NTLMv2 is the preferred protocol = for > -authentication, but since older machines do not support it, Samba has di= sabled > -it by default. Enable it with the following: > -
[global]
> -  client ntlmv2 auth =3D yes
> -
> - For the sake of backwards compatibility, most modern Windows > -machines will still allow other machines to communicate with them over w= eak > -protocols such as LANMAN. On Samba, by enabling NTLMv2, you are also dis= abling > -LANMAN and NTLMv1. If NTLMv1 is required, it is still possible to indiv= idually > -disable LANMAN. > - > - > - > -
> = > - > -Let Domain Controllers Create Machine Trust Accounts On-the-Fly</= title> > -<description>Add or correct an add machine script entry to the > -<tt>[global]</tt> section of <tt>/etc/samba/smb.conf</tt> to allow Samba= to > -dynamically create Machine Trust Accounts: > -<pre>[global] > - add machine script =3D /usr/sbin/useradd -n -g machines -d /dev/null -= s /sbin/nologin %u</pre> > -Make sure that the group machines exists. If not, add it with the follow= ing command: > -<pre># /usr/sbin/groupadd machines</pre> > -</description> > -<rationale>When acting as a PDC, it becomes necessary to create and store > -Machine Trust Accounts for each machine that joins the domain. On a Micr= osoft > -Windows PDC, this account is created with the Server Manager tool, but o= n a > -Samba PDC, two accounts must be created. The first is the local machine > -account, and the second is the Samba account. For security purposes, it = is > -recommended to let Samba create these accounts on-the-fly. When Machine = Trust > -Accounts are created manually, there is a small window of opportunity in= which > -a rogue machine could join the domain in place of the new server.</ratio= nale> > -<!--<ident cce=3D"TODO:CCE" />--> > -<!--<oval id=3D"smb_add_machine_script" />--> > -</Group> > - > -<Group id=3D"smb_restrict_access_ipc"> > -<title>Restrict Access to the [IPC$] Share > -Limit access to the [IPC$] share so that only mach= ines in > -your network will be able to connect to it: > -
[IPC$]
> -  hosts allow =3D 192.168.1. 127.0.0.1
> -  hosts deny =3D 0.0.0.0/0
> -
> -The [IPC$] share allows users to anonymously fetch a= list > -of shared resources from a server. It is intended to allow users to brow= se the > -list of available shares. It also can be used as a point of attack into a > -system. Disabling it completely may break some functionality, so it is > -recommended that you merely limit access to it instead. > - > - > - > -
> = > > -Restrict File Sharing > +Restrict SMB File Sharing to Configured Networks > Only users with local user accounts will be able to log in= to > Samba shares by default. Shares can be limited to particular users or n= etwork > addresses. Use the hosts allow and hosts deny directi= ves > accordingly, and consider setting the valid users directive to a limite= d subset > of users or to a group of users. Separate each address, user, or user g= roup > -with a space as follows: > -
[share]
> +with a space as follows for a particular share or global:
> +
[share]
>     hosts allow =3D 192.168.1. 127.0.0.1
>     valid users =3D userone usertwo @usergroup
> It is also possible to limit read and write access to particular users = with the > @@ -166,19 +69,32 @@ itself will override these settings. Set the read on= ly attribute for each share > to ensure that global settings will not accidentally override the indiv= idual > share settings. Then, as with the valid users directive, separate each = user or > group of users with a space: > -
[share]
> +
[share]
>     read only =3D yes
>     write list =3D userone usertwo @usergroup
> > - > The Samba service is only required for sharing files and pri= nters > -with Microsoft Windows workstations, and even then, other options may ex= ist. Do > -not use the Samba service to share files between Unix or Linux machines. > +with Microsoft Windows workstations, and even then, other options may ex= ist. > > - > - > > = > + > +Disable Root Access to SMB Shares > +Administrators should not use administrator accounts to acc= ess > +Samba file and printer shares. Disable the root user and the wheel > +administrator group: > +
[share]
> +  invalid users =3D root @wheel
> +If administrator accounts cannot be disabled, ensure that local machine > +passwords and Samba service passwords do not match.
> + > +Typically, administrator access is required when Samba must create user = and > +machine accounts and shares. Domain member servers and standalone server= s may > +not need administrator access at all. If that is the case, add the inval= id > +users parameter to [global] instead. > + > +
> + > > Require Client SMB Packet Signing, if using <tt>smbclient</tt></= title> > <description> > @@ -262,9 +178,7 @@ a space. For example, under the <tt>[printers]</tt> s= hare: > with Microsoft Windows workstations, and even then, other options may e= xist. Do > not use the Samba service to share files between Unix or Linux machines. > </rationale> > -<!--<ident cce=3D"TODO:CCE" />--> > -<!--<oval id=3D"smb_disable_printing" />--> > </Group> > = > -</Group> <!--<Group id=3D"configuring_samba">--> > -</Group> <!--<Group id=3D"smb">--> > +</Group> > +</Group> Ack -- = Shawn Wells Director, Innovation Programs shawn(a)redhat.com | 443.534.0130 @shawndwells --===============2485454304078093391==--