Title

Samba must be configured to use encrypted passwords. (Cat II impact)

Discussion

Samba must be configured to protect authenticators. If Samba passwords are not encrypted for storage, plain-text user passwords may be read by those with access to the Samba password file.

Check Content

Check the encryption setting of the Samba configuration. Procedure: # grep -i 'encrypt passwords' /etc/smb.conf /etc/sfw/smb.conf /etc/samba/smb.conf /etc/sfw/samba/smb.conf If the setting is not present, or not set to yes, this is a finding.

Fix Text

Edit the smb.conf file and change the encrypt passwords setting to yes.

Additional Identifiers

Rule ID: SV-227935r603266_rule

Vulnerability ID: V-227935

Group Title: SRG-OS-000480

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.