Title

Samba must be configured to use encrypted passwords. (Cat II impact)

Discussion

Samba must be configured to protect authenticators. If Samba passwords are not encrypted for storage, plain-text user passwords may be read by those with access to the Samba password file.

Check Content

If the "samba-common" package is not installed, this is not applicable. Check the encryption setting of Samba. # grep -i 'encrypt passwords' /etc/samba/smb.conf If the setting is not present, or not set to 'yes', this is a finding.

Fix Text

Edit the "/etc/samba/smb.conf" file and change the "encrypt passwords" setting to "yes".

Additional Identifiers

Rule ID: SV-46281r1_rule

Vulnerability ID: V-22500

Group Title: GEN006230

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.