The system must use SMB client signing for connecting to samba servers using smbclient.

From Red Hat Enterprise Linux 6 Security Technical Implementation Guide

Associated with: CCI-000366

SV-50457r1_rule The system must use SMB client signing for connecting to samba servers using smbclient.

Vulnerability discussion

Packet signing can prevent man-in-the-middle attacks which modify SMB packets in transit.

Check content

To verify that Samba clients running smbclient must use packet signing, run the following command: # grep signing /etc/samba/smb.conf The output should show: client signing = mandatory If it is not, this is a finding.

Fix text

To require samba clients running "smbclient" to use packet signing, add the following to the "[global]" section of the Samba configuration file in "/etc/samba/smb.conf": client signing = mandatory Requiring samba clients such as "smbclient" to use packet signing ensures they can only communicate with servers that support packet signing.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.