On 5/12/13 11:12 PM, Jeffrey Blank wrote:
Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
RHEL6/input/services/smb.xml | 134 ++++++++----------------------------------
1 files changed, 24 insertions(+), 110 deletions(-)
diff --git a/RHEL6/input/services/smb.xml b/RHEL6/input/services/smb.xml
index 3190439..f211170 100644
--- a/RHEL6/input/services/smb.xml
+++ b/RHEL6/input/services/smb.xml
@@ -49,115 +49,18 @@ and allow client machines to access local home directories and
printers. It is recommended that these settings be changed or that
additional limitations be set in place.</description>
-<!--Disabled for now as it's checking the default
-<Rule id="smb_server_disable_guest">
-<title>Ensure Guest Access is Disabled</title>
-<description>Ensure <tt>[global]</tt> or each share does not contain
-<tt>guest ok</tt> to <tt>yes</tt>. If so remove or set to:
-<pre>[share]
- guest ok = no</pre>
-Note that setting a share to <tt>guest ok = yes</tt> will override the
global
-settings. Ensure no share contains <tt>guest ok = yes</tt>. It is safe to
-disable local login support for remote Samba users. Consider changing the add
-user account script to set remote user shells to /sbin/nologin.
-</description>
-<rationale>
-Do not allow guest users to access local file or printer
shares.</rationale>-->
-<!--<ident cce="TODO:CCE" />-->
-<!--<oval id="smb_server_disable_guest" />-->
-<!--</Rule>-->
-
-<Rule id="smb_server_disable_root">
-<title>Disable Root Access</title>
-<description>Administrators should not use administrator accounts to access
-Samba file and printer shares. Disable the root user and the wheel
-administrator group:
-<pre>[share]
- invalid users = root @wheel</pre>
-If administrator accounts cannot be disabled, ensure that local machine
-passwords and Samba service passwords do not match.</description>
-<rationale>
-Typically, administrator access is required when Samba must create user and
-machine accounts and shares. Domain member servers and standalone servers may
-not need administrator access at all. If that is the case, add the invalid
-users parameter to [global] instead.
-</rationale>
-<!--<ident cce="TODO:CCE" />-->
-<!--<oval id="smb_server_disable_root" />-->
-</Rule>
-<Rule id="smb_set_auth_levels">
-<title>Disable Root Access</title>
-<description>By default, Samba will attempt to negotiate with Microsoft Windows
-machines to set a common communication protocol. Newer versions of Microsoft
-Windows may require the use of NTLMv2. NTLMv2 is the preferred protocol for
-authentication, but since older machines do not support it, Samba has disabled
-it by default. Enable it with the following:
-<pre>[global]
- client ntlmv2 auth = yes</pre>
-<!-- This is the default: Whenever possible, be sure to disable LANMAN
- authentication, as it is far weaker than the other supported protocols.
-<pre>[global]
- client lanman auth = no</pre>--> </description>
-<rationale> For the sake of backwards compatibility, most modern Windows
-machines will still allow other machines to communicate with them over weak
-protocols such as LANMAN. On Samba, by enabling NTLMv2, you are also disabling
-LANMAN and NTLMv1. If NTLMv1 is required, it is still possible to individually
-disable LANMAN.
-</rationale>
-<!--<ident cce="TODO:CCE" />-->
-<!--<oval id="smb_set_auth_levels" />-->
-</Rule>
-<Group id="smb_add_machine_script">
-<title>Let Domain Controllers Create Machine Trust Accounts
On-the-Fly</title>
-<description>Add or correct an add machine script entry to the
-<tt>[global]</tt> section of <tt>/etc/samba/smb.conf</tt> to
allow Samba to
-dynamically create Machine Trust Accounts:
-<pre>[global]
- add machine script = /usr/sbin/useradd -n -g machines -d /dev/null -s /sbin/nologin
%u</pre>
-Make sure that the group machines exists. If not, add it with the following command:
-<pre># /usr/sbin/groupadd machines</pre>
-</description>
-<rationale>When acting as a PDC, it becomes necessary to create and store
-Machine Trust Accounts for each machine that joins the domain. On a Microsoft
-Windows PDC, this account is created with the Server Manager tool, but on a
-Samba PDC, two accounts must be created. The first is the local machine
-account, and the second is the Samba account. For security purposes, it is
-recommended to let Samba create these accounts on-the-fly. When Machine Trust
-Accounts are created manually, there is a small window of opportunity in which
-a rogue machine could join the domain in place of the new server.</rationale>
-<!--<ident cce="TODO:CCE" />-->
-<!--<oval id="smb_add_machine_script" />-->
-</Group>
-
-<Group id="smb_restrict_access_ipc">
-<title>Restrict Access to the [IPC$] Share</title>
-<description>Limit access to the <tt>[IPC$]</tt> share so that only
machines in
-your network will be able to connect to it:
-<pre>[IPC$]
- hosts allow = 192.168.1. 127.0.0.1
- hosts deny = 0.0.0.0/0</pre>
-</description>
-<rationale>The <tt>[IPC$]</tt> share allows users to anonymously fetch
a list
-of shared resources from a server. It is intended to allow users to browse the
-list of available shares. It also can be used as a point of attack into a
-system. Disabling it completely may break some functionality, so it is
-recommended that you merely limit access to it instead.
-</rationale>
-<!--<ident cce="TODO:CCE" />-->
-<!--<oval id="smb_restrict_access_ipc" />-->
-</Group>
<Group id="smb_restrict_file_sharing">
-<title>Restrict File Sharing</title>
+<title>Restrict SMB File Sharing to Configured Networks</title>
<description>Only users with local user accounts will be able to log in to
Samba shares by default. Shares can be limited to particular users or network
addresses. Use the <tt>hosts allow</tt> and <tt>hosts deny</tt>
directives
accordingly, and consider setting the valid users directive to a limited subset
of users or to a group of users. Separate each address, user, or user group
-with a space as follows:
-<pre>[share]
+with a space as follows for a particular <i>share</i> or global:
+<pre>[<i>share</i>]
hosts allow = 192.168.1. 127.0.0.1
valid users = userone usertwo @usergroup</pre>
It is also possible to limit read and write access to particular users with the
@@ -166,19 +69,32 @@ itself will override these settings. Set the read only attribute for
each share
to ensure that global settings will not accidentally override the individual
share settings. Then, as with the valid users directive, separate each user or
group of users with a space:
-<pre>[share]
+<pre>[<i>share</i>]
read only = yes
write list = userone usertwo @usergroup</pre>
</description>
-
<rationale>The Samba service is only required for sharing files and printers
-with Microsoft Windows workstations, and even then, other options may exist. Do
-not use the Samba service to share files between Unix or Linux machines.
+with Microsoft Windows workstations, and even then, other options may exist.
</rationale>
-<!--<ident cce="TODO:CCE" />-->
-<!--<oval id="smb_restrict_file_sharing" />-->
</Group>
+<Rule id="smb_server_disable_root">
+<title>Disable Root Access to SMB Shares</title>
+<description>Administrators should not use administrator accounts to access
+Samba file and printer shares. Disable the root user and the wheel
+administrator group:
+<pre>[<i>share</i>]
+ invalid users = root @wheel</pre>
+If administrator accounts cannot be disabled, ensure that local machine
+passwords and Samba service passwords do not match.</description>
+<rationale>
+Typically, administrator access is required when Samba must create user and
+machine accounts and shares. Domain member servers and standalone servers may
+not need administrator access at all. If that is the case, add the invalid
+users parameter to <tt>[global]</tt> instead.
+</rationale>
+</Rule>
+
<Rule id="require_smb_client_signing">
<title>Require Client SMB Packet Signing, if using
<tt>smbclient</tt></title>
<description>
@@ -262,9 +178,7 @@ a space. For example, under the <tt>[printers]</tt>
share:
with Microsoft Windows workstations, and even then, other options may exist. Do
not use the Samba service to share files between Unix or Linux machines.
</rationale>
-<!--<ident cce="TODO:CCE" />-->
-<!--<oval id="smb_disable_printing" />-->
</Group>
-</Group> <!--<Group id="configuring_samba">-->
-</Group> <!--<Group id="smb">-->
+</Group>
+</Group>
Ack
--
Shawn Wells
Director, Innovation Programs
shawn(a)redhat.com | 443.534.0130
@shawndwells