Signed-off-by: David Smith dsmith@eclipse.ncsc.mil --- RHEL6/input/services/smb.xml | 124 ++++++++++++++++++++++++++++++------------ 1 files changed, 89 insertions(+), 35 deletions(-)
diff --git a/RHEL6/input/services/smb.xml b/RHEL6/input/services/smb.xml index 80481b5..7c54e33 100644 --- a/RHEL6/input/services/smb.xml +++ b/RHEL6/input/services/smb.xml @@ -53,8 +53,10 @@ additional limitations be set in place.</description> <tt>guest ok</tt> to <tt>yes</tt>. If so remove or set to: <pre>[share] guest ok = no</pre> -Note that setting a share to <tt>guest ok = yes</tt> will override the global settings. Ensure no share contains <tt>guest ok = yes</tt>. -It is safe to disable local login support for remote Samba users. Consider changing the add user account script to set remote user shells to /sbin/nologin. +Note that setting a share to <tt>guest ok = yes</tt> will override the global +settings. Ensure no share contains <tt>guest ok = yes</tt>. It is safe to +disable local login support for remote Samba users. Consider changing the add +user account script to set remote user shells to /sbin/nologin. </description> <rationale> Do not allow guest users to access local file or printer shares.</rationale>--> @@ -64,12 +66,18 @@ Do not allow guest users to access local file or printer shares.</rationale>-->
<Rule id="smb_server_disable_root"> <title>Disable Root Access</title> -<description>Administrators should not use administrator accounts to access Samba file and printer shares. Disable the root user and the wheel administrator group: +<description>Administrators should not use administrator accounts to access +Samba file and printer shares. Disable the root user and the wheel +administrator group: <pre>[share] invalid users = root @wheel</pre> -If administrator accounts cannot be disabled, ensure that local machine passwords and Samba service passwords do not match.</description> +If administrator accounts cannot be disabled, ensure that local machine +passwords and Samba service passwords do not match.</description> <rationale> -Typically, administrator access is required when Samba must create user and machine accounts and shares. Domain member servers and standalone servers may not need administrator access at all. If that is the case, add the invalid users parameter to [global] instead. +Typically, administrator access is required when Samba must create user and +machine accounts and shares. Domain member servers and standalone servers may +not need administrator access at all. If that is the case, add the invalid +users parameter to [global] instead. </rationale> <!--<ident cce="TODO:CCE" />--> <!--<oval id="smb_server_disable_root" />--> @@ -77,62 +85,96 @@ Typically, administrator access is required when Samba must create user and mach
<Rule id="smb_set_auth_levels"> <title>Disable Root Access</title> -<description>By default, Samba will attempt to negotiate with Microsoft Windows machines to set a common communication protocol. -Newer versions of Microsoft Windows may require the use of NTLMv2. NTLMv2 is the preferred protocol for authentication, but since older machines do not support it, Samba has disabled it by default. Enable it with the following: +<description>By default, Samba will attempt to negotiate with Microsoft Windows +machines to set a common communication protocol. Newer versions of Microsoft +Windows may require the use of NTLMv2. NTLMv2 is the preferred protocol for +authentication, but since older machines do not support it, Samba has disabled +it by default. Enable it with the following: <pre>[global] client ntlmv2 auth = yes</pre> -<!-- This is the default: Whenever possible, be sure to disable LANMAN authentication, as it is far weaker than the other supported protocols. +<!-- This is the default: Whenever possible, be sure to disable LANMAN + authentication, as it is far weaker than the other supported protocols. <pre>[global] - client lanman auth = no</pre>--> -</description> -<rationale> -For the sake of backwards compatibility, most modern Windows machines will still allow other machines to communicate with them over weak protocols such as LANMAN. On Samba, by enabling NTLMv2, you are also disabling LANMAN and NTLMv1. If NTLMv1 is required, it is still possible to individually disable LANMAN.</rationale> + client lanman auth = no</pre>--> </description> +<rationale> For the sake of backwards compatibility, most modern Windows +machines will still allow other machines to communicate with them over weak +protocols such as LANMAN. On Samba, by enabling NTLMv2, you are also disabling +LANMAN and NTLMv1. If NTLMv1 is required, it is still possible to individually +disable LANMAN. +</rationale> <!--<ident cce="TODO:CCE" />--> <!--<oval id="smb_set_auth_levels" />--> </Rule>
-<Rule id="smb_add_machine_script"> +<Group id="smb_add_machine_script"> <title>Let Domain Controllers Create Machine Trust Accounts On-the-Fly</title> -<description>Add or correct an add machine script entry to the <tt>[global]</tt> section of <tt>/etc/samba/smb.conf</tt> to allow -Samba to dynamically create Machine Trust Accounts: +<description>Add or correct an add machine script entry to the +<tt>[global]</tt> section of <tt>/etc/samba/smb.conf</tt> to allow Samba to +dynamically create Machine Trust Accounts: <pre>[global] add machine script = /usr/sbin/useradd -n -g machines -d /dev/null -s /sbin/nologin %u</pre> Make sure that the group machines exists. If not, add it with the following command: <pre># /usr/sbin/groupadd machines</pre> </description> -<rationale>When acting as a PDC, it becomes necessary to create and store Machine Trust Accounts for each machine that joins the domain. On a Microsoft Windows PDC, this account is created with the Server Manager tool, but on a Samba PDC, two accounts must be created. The first is the local machine account, and the second is the Samba account. For security purposes, it is recommended to let Samba create these accounts on-the-fly. When Machine Trust Accounts are created manually, there is a small window of opportunity in which a rogue machine could join the domain in place of the new server.</rationale> +<rationale>When acting as a PDC, it becomes necessary to create and store +Machine Trust Accounts for each machine that joins the domain. On a Microsoft +Windows PDC, this account is created with the Server Manager tool, but on a +Samba PDC, two accounts must be created. The first is the local machine +account, and the second is the Samba account. For security purposes, it is +recommended to let Samba create these accounts on-the-fly. When Machine Trust +Accounts are created manually, there is a small window of opportunity in which +a rogue machine could join the domain in place of the new server.</rationale> <!--<ident cce="TODO:CCE" />--> <!--<oval id="smb_add_machine_script" />--> -</Rule> +</Group>
-<Rule id="smb_restrict_access_ipc"> +<Group id="smb_restrict_access_ipc"> <title>Restrict Access to the [IPC$] Share</title> -<description>Limit access to the <tt>[IPC$]</tt> share so that only machines in your network will be able to connect to it: +<description>Limit access to the <tt>[IPC$]</tt> share so that only machines in +your network will be able to connect to it: <pre>[IPC$] hosts allow = 192.168.1. 127.0.0.1 hosts deny = 0.0.0.0/0</pre> </description> -<rationale>The <tt>[IPC$]</tt> share allows users to anonymously fetch a list of shared resources from a server. It is intended to allow users to browse the list of available shares. It also can be used as a point of attack into a system. Disabling it completely may break some functionality, so it is recommended that you merely limit access to it instead.</rationale> +<rationale>The <tt>[IPC$]</tt> share allows users to anonymously fetch a list +of shared resources from a server. It is intended to allow users to browse the +list of available shares. It also can be used as a point of attack into a +system. Disabling it completely may break some functionality, so it is +recommended that you merely limit access to it instead. +</rationale> <!--<ident cce="TODO:CCE" />--> <!--<oval id="smb_restrict_access_ipc" />--> -</Rule> +</Group>
-<Rule id="smb_restrict_file_sharing"> +<Group id="smb_restrict_file_sharing"> <title>Restrict File Sharing</title> -<description>Only users with local user accounts will be able to log in to Samba shares by default. Shares can be limited to particular users or network addresses. Use the <tt>hosts allow</tt> and <tt>hosts deny</tt> directives accordingly, and consider setting the valid users directive to a limited subset of users or to a group of users. Separate each -address, user, or user group with a space as follows: +<description>Only users with local user accounts will be able to log in to +Samba shares by default. Shares can be limited to particular users or network +addresses. Use the <tt>hosts allow</tt> and <tt>hosts deny</tt> directives +accordingly, and consider setting the valid users directive to a limited subset +of users or to a group of users. Separate each address, user, or user group +with a space as follows: <pre>[share] hosts allow = 192.168.1. 127.0.0.1 valid users = userone usertwo @usergroup</pre> -It is also possible to limit read and write access to particular users with the read list and write list options, though the permissions set by the system itself will override these settings. Set the read only attribute for each share to ensure that global settings will not accidentally override the individual share settings. Then, as with the valid users directive, separate each user or group of users with a space: +It is also possible to limit read and write access to particular users with the +read list and write list options, though the permissions set by the system +itself will override these settings. Set the read only attribute for each share +to ensure that global settings will not accidentally override the individual +share settings. Then, as with the valid users directive, separate each user or +group of users with a space: <pre>[share] read only = yes write list = userone usertwo @usergroup</pre> </description> -<rationale>The Samba service is only required for sharing files and printers with Microsoft Windows workstations, and even then, other options may exist. Do not use the Samba service to share files between Unix or Linux machines. </rationale> + +<rationale>The Samba service is only required for sharing files and printers +with Microsoft Windows workstations, and even then, other options may exist. Do +not use the Samba service to share files between Unix or Linux machines. +</rationale> <!--<ident cce="TODO:CCE" />--> <!--<oval id="smb_restrict_file_sharing" />--> -</Rule> +</Group>
<Rule id="require_smb_client_signing"> <title>Require Client SMB Packet Signing, if using @@ -157,8 +199,7 @@ transit.
<Rule id="require_smb_client_signing_mount.cifs"> -<title>Require Client SMB Packet Signing, if using -mount.cifs</title> +<title>Require Client SMB Packet Signing, if using mount.cifs</title> <description>Require packet signing of clients who mount Samba shares using the <tt>mount.cifs</tt> program (e.g., those who specify shares in <tt>/etc/fstab</tt>). To do so, ensure that signing options (either @@ -176,9 +217,13 @@ attacks which modify SMB packets in transit. <oval id="mount_option_smb_client_signing" /> </Rule>
-<Rule id="smb_disable_printing"> +<Group id="smb_disable_printing"> <title>Restrict Printer Sharing</title> -<description>By default, Samba utilizes the CUPS printing service to enable printer sharing with Microsoft Windows workstations. If there are no printers on the local machine, or if printer sharing with Microsoft Windows is not required, disable the printer sharing capability by commenting out the following lines, found in <tt>/etc/samba/smb.conf</tt>: +<description>By default, Samba utilizes the CUPS printing service to enable +printer sharing with Microsoft Windows workstations. If there are no printers +on the local machine, or if printer sharing with Microsoft Windows is not +required, disable the printer sharing capability by commenting out the +following lines, found in <tt>/etc/samba/smb.conf</tt>: <pre>[global] load printers = yes cups options = raw @@ -189,15 +234,24 @@ attacks which modify SMB packets in transit. guest ok = no writable = no printable = yes</pre> -There may be other options present, but these are the only options enabled and uncommented by default. Removing the <tt>[printers]</tt> share should be enough for most users. -If the Samba printer sharing capability is needed, consider disabling the Samba network browsing capability or restricting access to a particular set of users or network addresses. Set the <tt>valid users</tt> parameter to a small subset of users or restrict it to a particular group of users with the shorthand <tt>@</tt>. Separate each user or group of users with a space. For example, under the <tt>[printers]</tt> share: +There may be other options present, but these are the only options enabled and +uncommented by default. Removing the <tt>[printers]</tt> share should be enough +for most users. If the Samba printer sharing capability is needed, consider +disabling the Samba network browsing capability or restricting access to a +particular set of users or network addresses. Set the <tt>valid users</tt> +parameter to a small subset of users or restrict it to a particular group of +users with the shorthand <tt>@</tt>. Separate each user or group of users with +a space. For example, under the <tt>[printers]</tt> share: <pre>[printers] valid users = user @printerusers</pre> </description> -<rationale>The Samba service is only required for sharing files and printers with Microsoft Windows workstations, and even then, other options may exist. Do not use the Samba service to share files between Unix or Linux machines. </rationale> +<rationale>The Samba service is only required for sharing files and printers +with Microsoft Windows workstations, and even then, other options may exist. Do +not use the Samba service to share files between Unix or Linux machines. +</rationale> <!--<ident cce="TODO:CCE" />--> <!--<oval id="smb_disable_printing" />--> -</Rule> +</Group>
</Group> <!--<Group id="configuring_samba">--> </Group> <!--<Group id="smb">-->