[PATCH 3/3] removed some now-obsolete advice from samba

Jeffrey Blank blank at eclipse.ncsc.mil
Mon May 13 03:12:30 UTC 2013


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/input/services/smb.xml |  134 ++++++++----------------------------------
 1 files changed, 24 insertions(+), 110 deletions(-)

diff --git a/RHEL6/input/services/smb.xml b/RHEL6/input/services/smb.xml
index 3190439..f211170 100644
--- a/RHEL6/input/services/smb.xml
+++ b/RHEL6/input/services/smb.xml
@@ -49,115 +49,18 @@ and allow client machines to access local home directories and
 printers. It is recommended that these settings be changed or that
 additional limitations be set in place.</description>
 
-<!--Disabled for now as it's checking the default
-<Rule id="smb_server_disable_guest">
-<title>Ensure Guest Access is Disabled</title>
-<description>Ensure <tt>[global]</tt> or each share does not contain
-<tt>guest ok</tt> to <tt>yes</tt>. If so remove or set to:
-<pre>[share]
-  guest ok = no</pre>
-Note that setting a share to <tt>guest ok = yes</tt> will override the global
-settings. Ensure no share contains <tt>guest ok = yes</tt>.  It is safe to
-disable local login support for remote Samba users. Consider changing the add
-user account script to set remote user shells to /sbin/nologin.
-</description>
-<rationale>
-Do not allow guest users to access local file or printer shares.</rationale>-->
-<!--<ident cce="TODO:CCE" />-->
-<!--<oval id="smb_server_disable_guest" />-->
-<!--</Rule>-->
-
-<Rule id="smb_server_disable_root">
-<title>Disable Root Access</title>
-<description>Administrators should not use administrator accounts to access
-Samba file and printer shares. Disable the root user and the wheel
-administrator group:
-<pre>[share]
-  invalid users = root @wheel</pre>
-If administrator accounts cannot be disabled, ensure that local machine
-passwords and Samba service passwords do not match.</description>
-<rationale>
-Typically, administrator access is required when Samba must create user and
-machine accounts and shares. Domain member servers and standalone servers may
-not need administrator access at all. If that is the case, add the invalid
-users parameter to [global] instead.
-</rationale>
-<!--<ident cce="TODO:CCE" />-->
-<!--<oval id="smb_server_disable_root" />-->
-</Rule>
 
-<Rule id="smb_set_auth_levels">
-<title>Disable Root Access</title>
-<description>By default, Samba will attempt to negotiate with Microsoft Windows
-machines to set a common communication protocol.  Newer versions of Microsoft
-Windows may require the use of NTLMv2. NTLMv2 is the preferred protocol for
-authentication, but since older machines do not support it, Samba has disabled
-it by default. Enable it with the following:
-<pre>[global]
-  client ntlmv2 auth = yes</pre>
-<!-- This is the default: Whenever possible, be sure to disable LANMAN
-     authentication, as it is far weaker than the other supported protocols.
-<pre>[global]
-  client lanman auth = no</pre>--> </description>
-<rationale> For the sake of backwards compatibility, most modern Windows
-machines will still allow other machines to communicate with them over weak
-protocols such as LANMAN. On Samba, by enabling NTLMv2, you are also disabling
-LANMAN and NTLMv1.  If NTLMv1 is required, it is still possible to individually
-disable LANMAN.
-</rationale>
-<!--<ident cce="TODO:CCE" />-->
-<!--<oval id="smb_set_auth_levels" />-->
-</Rule>
 
-<Group id="smb_add_machine_script">
-<title>Let Domain Controllers Create Machine Trust Accounts On-the-Fly</title>
-<description>Add or correct an add machine script entry to the
-<tt>[global]</tt> section of <tt>/etc/samba/smb.conf</tt> to allow Samba to
-dynamically create Machine Trust Accounts:
-<pre>[global]
-  add machine script = /usr/sbin/useradd -n -g machines -d /dev/null -s /sbin/nologin %u</pre>
-Make sure that the group machines exists. If not, add it with the following command:
-<pre># /usr/sbin/groupadd machines</pre>
-</description>
-<rationale>When acting as a PDC, it becomes necessary to create and store
-Machine Trust Accounts for each machine that joins the domain. On a Microsoft
-Windows PDC, this account is created with the Server Manager tool, but on a
-Samba PDC, two accounts must be created. The first is the local machine
-account, and the second is the Samba account. For security purposes, it is
-recommended to let Samba create these accounts on-the-fly. When Machine Trust
-Accounts are created manually, there is a small window of opportunity in which
-a rogue machine could join the domain in place of the new server.</rationale>
-<!--<ident cce="TODO:CCE" />-->
-<!--<oval id="smb_add_machine_script" />-->
-</Group>
-
-<Group id="smb_restrict_access_ipc">
-<title>Restrict Access to the [IPC$] Share</title>
-<description>Limit access to the <tt>[IPC$]</tt> share so that only machines in
-your network will be able to connect to it:
-<pre>[IPC$]
-  hosts allow = 192.168.1. 127.0.0.1
-  hosts deny = 0.0.0.0/0</pre>
-</description>
-<rationale>The <tt>[IPC$]</tt> share allows users to anonymously fetch a list
-of shared resources from a server. It is intended to allow users to browse the
-list of available shares. It also can be used as a point of attack into a
-system. Disabling it completely may break some functionality, so it is
-recommended that you merely limit access to it instead.
-</rationale>
-<!--<ident cce="TODO:CCE" />-->
-<!--<oval id="smb_restrict_access_ipc" />-->
-</Group>
 
 <Group id="smb_restrict_file_sharing">
-<title>Restrict File Sharing</title>
+<title>Restrict SMB File Sharing to Configured Networks</title>
 <description>Only users with local user accounts will be able to log in to
 Samba shares by default. Shares can be limited to particular users or network
 addresses. Use the <tt>hosts allow</tt> and <tt>hosts deny</tt> directives
 accordingly, and consider setting the valid users directive to a limited subset
 of users or to a group of users. Separate each address, user, or user group
-with a space as follows:
-<pre>[share]
+with a space as follows for a particular <i>share</i> or global:
+<pre>[<i>share</i>]
   hosts allow = 192.168.1. 127.0.0.1
   valid users = userone usertwo @usergroup</pre>
 It is also possible to limit read and write access to particular users with the
@@ -166,19 +69,32 @@ itself will override these settings. Set the read only attribute for each share
 to ensure that global settings will not accidentally override the individual
 share settings. Then, as with the valid users directive, separate each user or
 group of users with a space:
-<pre>[share]
+<pre>[<i>share</i>]
   read only = yes
   write list = userone usertwo @usergroup</pre>
 </description>
-
 <rationale>The Samba service is only required for sharing files and printers
-with Microsoft Windows workstations, and even then, other options may exist. Do
-not use the Samba service to share files between Unix or Linux machines.
+with Microsoft Windows workstations, and even then, other options may exist. 
 </rationale>
-<!--<ident cce="TODO:CCE" />-->
-<!--<oval id="smb_restrict_file_sharing" />-->
 </Group>
 
+<Rule id="smb_server_disable_root">
+<title>Disable Root Access to SMB Shares</title>
+<description>Administrators should not use administrator accounts to access
+Samba file and printer shares. Disable the root user and the wheel
+administrator group:
+<pre>[<i>share</i>]
+  invalid users = root @wheel</pre>
+If administrator accounts cannot be disabled, ensure that local machine
+passwords and Samba service passwords do not match.</description>
+<rationale>
+Typically, administrator access is required when Samba must create user and
+machine accounts and shares. Domain member servers and standalone servers may
+not need administrator access at all. If that is the case, add the invalid
+users parameter to <tt>[global]</tt> instead.
+</rationale>
+</Rule>
+
 <Rule id="require_smb_client_signing">
 <title>Require Client SMB Packet Signing, if using <tt>smbclient</tt></title>
 <description>
@@ -262,9 +178,7 @@ a space. For example, under the <tt>[printers]</tt> share:
 with Microsoft Windows workstations, and even then, other options may exist. Do
 not use the Samba service to share files between Unix or Linux machines.
 </rationale>
-<!--<ident cce="TODO:CCE" />-->
-<!--<oval id="smb_disable_printing" />-->
 </Group>
 
-</Group> <!--<Group id="configuring_samba">-->
-</Group> <!--<Group id="smb">-->
+</Group>
+</Group>
-- 
1.7.1



More information about the scap-security-guide mailing list