[PATCH 3/3] removed some now-obsolete advice from samba

Shawn Wells shawn at redhat.com
Mon May 13 03:24:59 UTC 2013


On 5/12/13 11:12 PM, Jeffrey Blank wrote:
> Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
> ---
>   RHEL6/input/services/smb.xml |  134 ++++++++----------------------------------
>   1 files changed, 24 insertions(+), 110 deletions(-)
>
> diff --git a/RHEL6/input/services/smb.xml b/RHEL6/input/services/smb.xml
> index 3190439..f211170 100644
> --- a/RHEL6/input/services/smb.xml
> +++ b/RHEL6/input/services/smb.xml
> @@ -49,115 +49,18 @@ and allow client machines to access local home directories and
>   printers. It is recommended that these settings be changed or that
>   additional limitations be set in place.</description>
>   
> -<!--Disabled for now as it's checking the default
> -<Rule id="smb_server_disable_guest">
> -<title>Ensure Guest Access is Disabled</title>
> -<description>Ensure <tt>[global]</tt> or each share does not contain
> -<tt>guest ok</tt> to <tt>yes</tt>. If so remove or set to:
> -<pre>[share]
> -  guest ok = no</pre>
> -Note that setting a share to <tt>guest ok = yes</tt> will override the global
> -settings. Ensure no share contains <tt>guest ok = yes</tt>.  It is safe to
> -disable local login support for remote Samba users. Consider changing the add
> -user account script to set remote user shells to /sbin/nologin.
> -</description>
> -<rationale>
> -Do not allow guest users to access local file or printer shares.</rationale>-->
> -<!--<ident cce="TODO:CCE" />-->
> -<!--<oval id="smb_server_disable_guest" />-->
> -<!--</Rule>-->
> -
> -<Rule id="smb_server_disable_root">
> -<title>Disable Root Access</title>
> -<description>Administrators should not use administrator accounts to access
> -Samba file and printer shares. Disable the root user and the wheel
> -administrator group:
> -<pre>[share]
> -  invalid users = root @wheel</pre>
> -If administrator accounts cannot be disabled, ensure that local machine
> -passwords and Samba service passwords do not match.</description>
> -<rationale>
> -Typically, administrator access is required when Samba must create user and
> -machine accounts and shares. Domain member servers and standalone servers may
> -not need administrator access at all. If that is the case, add the invalid
> -users parameter to [global] instead.
> -</rationale>
> -<!--<ident cce="TODO:CCE" />-->
> -<!--<oval id="smb_server_disable_root" />-->
> -</Rule>
>   
> -<Rule id="smb_set_auth_levels">
> -<title>Disable Root Access</title>
> -<description>By default, Samba will attempt to negotiate with Microsoft Windows
> -machines to set a common communication protocol.  Newer versions of Microsoft
> -Windows may require the use of NTLMv2. NTLMv2 is the preferred protocol for
> -authentication, but since older machines do not support it, Samba has disabled
> -it by default. Enable it with the following:
> -<pre>[global]
> -  client ntlmv2 auth = yes</pre>
> -<!-- This is the default: Whenever possible, be sure to disable LANMAN
> -     authentication, as it is far weaker than the other supported protocols.
> -<pre>[global]
> -  client lanman auth = no</pre>--> </description>
> -<rationale> For the sake of backwards compatibility, most modern Windows
> -machines will still allow other machines to communicate with them over weak
> -protocols such as LANMAN. On Samba, by enabling NTLMv2, you are also disabling
> -LANMAN and NTLMv1.  If NTLMv1 is required, it is still possible to individually
> -disable LANMAN.
> -</rationale>
> -<!--<ident cce="TODO:CCE" />-->
> -<!--<oval id="smb_set_auth_levels" />-->
> -</Rule>
>   
> -<Group id="smb_add_machine_script">
> -<title>Let Domain Controllers Create Machine Trust Accounts On-the-Fly</title>
> -<description>Add or correct an add machine script entry to the
> -<tt>[global]</tt> section of <tt>/etc/samba/smb.conf</tt> to allow Samba to
> -dynamically create Machine Trust Accounts:
> -<pre>[global]
> -  add machine script = /usr/sbin/useradd -n -g machines -d /dev/null -s /sbin/nologin %u</pre>
> -Make sure that the group machines exists. If not, add it with the following command:
> -<pre># /usr/sbin/groupadd machines</pre>
> -</description>
> -<rationale>When acting as a PDC, it becomes necessary to create and store
> -Machine Trust Accounts for each machine that joins the domain. On a Microsoft
> -Windows PDC, this account is created with the Server Manager tool, but on a
> -Samba PDC, two accounts must be created. The first is the local machine
> -account, and the second is the Samba account. For security purposes, it is
> -recommended to let Samba create these accounts on-the-fly. When Machine Trust
> -Accounts are created manually, there is a small window of opportunity in which
> -a rogue machine could join the domain in place of the new server.</rationale>
> -<!--<ident cce="TODO:CCE" />-->
> -<!--<oval id="smb_add_machine_script" />-->
> -</Group>
> -
> -<Group id="smb_restrict_access_ipc">
> -<title>Restrict Access to the [IPC$] Share</title>
> -<description>Limit access to the <tt>[IPC$]</tt> share so that only machines in
> -your network will be able to connect to it:
> -<pre>[IPC$]
> -  hosts allow = 192.168.1. 127.0.0.1
> -  hosts deny = 0.0.0.0/0</pre>
> -</description>
> -<rationale>The <tt>[IPC$]</tt> share allows users to anonymously fetch a list
> -of shared resources from a server. It is intended to allow users to browse the
> -list of available shares. It also can be used as a point of attack into a
> -system. Disabling it completely may break some functionality, so it is
> -recommended that you merely limit access to it instead.
> -</rationale>
> -<!--<ident cce="TODO:CCE" />-->
> -<!--<oval id="smb_restrict_access_ipc" />-->
> -</Group>
>   
>   <Group id="smb_restrict_file_sharing">
> -<title>Restrict File Sharing</title>
> +<title>Restrict SMB File Sharing to Configured Networks</title>
>   <description>Only users with local user accounts will be able to log in to
>   Samba shares by default. Shares can be limited to particular users or network
>   addresses. Use the <tt>hosts allow</tt> and <tt>hosts deny</tt> directives
>   accordingly, and consider setting the valid users directive to a limited subset
>   of users or to a group of users. Separate each address, user, or user group
> -with a space as follows:
> -<pre>[share]
> +with a space as follows for a particular <i>share</i> or global:
> +<pre>[<i>share</i>]
>     hosts allow = 192.168.1. 127.0.0.1
>     valid users = userone usertwo @usergroup</pre>
>   It is also possible to limit read and write access to particular users with the
> @@ -166,19 +69,32 @@ itself will override these settings. Set the read only attribute for each share
>   to ensure that global settings will not accidentally override the individual
>   share settings. Then, as with the valid users directive, separate each user or
>   group of users with a space:
> -<pre>[share]
> +<pre>[<i>share</i>]
>     read only = yes
>     write list = userone usertwo @usergroup</pre>
>   </description>
> -
>   <rationale>The Samba service is only required for sharing files and printers
> -with Microsoft Windows workstations, and even then, other options may exist. Do
> -not use the Samba service to share files between Unix or Linux machines.
> +with Microsoft Windows workstations, and even then, other options may exist.
>   </rationale>
> -<!--<ident cce="TODO:CCE" />-->
> -<!--<oval id="smb_restrict_file_sharing" />-->
>   </Group>
>   
> +<Rule id="smb_server_disable_root">
> +<title>Disable Root Access to SMB Shares</title>
> +<description>Administrators should not use administrator accounts to access
> +Samba file and printer shares. Disable the root user and the wheel
> +administrator group:
> +<pre>[<i>share</i>]
> +  invalid users = root @wheel</pre>
> +If administrator accounts cannot be disabled, ensure that local machine
> +passwords and Samba service passwords do not match.</description>
> +<rationale>
> +Typically, administrator access is required when Samba must create user and
> +machine accounts and shares. Domain member servers and standalone servers may
> +not need administrator access at all. If that is the case, add the invalid
> +users parameter to <tt>[global]</tt> instead.
> +</rationale>
> +</Rule>
> +
>   <Rule id="require_smb_client_signing">
>   <title>Require Client SMB Packet Signing, if using <tt>smbclient</tt></title>
>   <description>
> @@ -262,9 +178,7 @@ a space. For example, under the <tt>[printers]</tt> share:
>   with Microsoft Windows workstations, and even then, other options may exist. Do
>   not use the Samba service to share files between Unix or Linux machines.
>   </rationale>
> -<!--<ident cce="TODO:CCE" />-->
> -<!--<oval id="smb_disable_printing" />-->
>   </Group>
>   
> -</Group> <!--<Group id="configuring_samba">-->
> -</Group> <!--<Group id="smb">-->
> +</Group>
> +</Group>

Ack

-- 
Shawn Wells
Director, Innovation Programs
shawn at redhat.com | 443.534.0130
@shawndwells



More information about the scap-security-guide mailing list