Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-22500 | GEN006230 | SV-37894r2_rule | IAIA-1 IAIA-2 | Medium |
Description |
---|
Samba must be configured to protect authenticators. If Samba passwords are not encrypted for storage, plain-text user passwords may be read by those with access to the Samba password file. |
STIG | Date |
---|---|
Red Hat Enterprise Linux 5 Security Technical Implementation Guide | 2014-01-09 |
Check Text ( C-37120r3_chk ) |
---|
If the "samba-common" package is not installed, this is not applicable. Check the encryption setting of Samba. # grep -i 'encrypt passwords' /etc/samba/smb.conf If the setting is not present, or not set to 'yes', this is a finding. |
Fix Text (F-32388r1_fix) |
---|
Edit the "/etc/samba/smb.conf" file and change the "encrypt passwords" setting to "yes". |