Check: OL6-00-000273
Oracle Linux 6 STIG:
OL6-00-000273
(in versions v2 r7 through v1 r9)
Title
The system must use SMB client signing for connecting to samba servers using mount.cifs. (Cat III impact)
Discussion
Packet signing can prevent man-in-the-middle attacks which modify SMB packets in transit.
Check Content
If Samba is not in use, this is not applicable. To verify that Samba clients using mount.cifs must use packet signing, run the following command: # grep sec /etc/fstab /etc/mtab The output should show either "krb5i" or "ntlmv2i" in use. If it does not, this is a finding.
Fix Text
Require packet signing of clients who mount Samba shares using the "mount.cifs" program (e.g., those who specify shares in "/etc/fstab"). To do so, ensure signing options (either "sec=krb5i" or "sec=ntlmv2i") are used. See the "mount.cifs(8)" man page for more information. A Samba client should only communicate with servers who can support SMB packet signing.
Additional Identifiers
Rule ID: SV-209011r793732_rule
Vulnerability ID: V-209011
Group Title: SRG-OS-000480
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000366 |
The organization implements the security configuration settings. |
Controls
Number | Title |
---|---|
CM-6 |
Configuration Settings |