Samba must be configured to use encrypted passwords.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22500	GEN006230	SV-26831r2_rule		Medium

Description
Samba must be configured to protect authenticators. If Samba passwords are not encrypted for storage, plain-text user passwords may be read by those with access to the Samba password file.

STIG	Date
VMware ESX 3 Server	2016-05-13

Details

Check Text ( C-27814r3_chk )
Check the encryption setting of the Samba configuration. Default locations for this file include /etc, /etc/sfw, /etc/samba, and /etc/sfw/samba. If the system has Samba installed in non-standard locations, also check the smb.conf in those locations. Procedure: # grep -i 'encrypt passwords' /etc/smb.conf /etc/sfw/smb.conf /etc/samba/smb.conf /etc/sfw/samba/smb.conf If the setting is not present, or not set to yes, this is a finding.

Check Text ( C-27814r3_chk )

Check the encryption setting of the Samba configuration. Default locations for this file include /etc, /etc/sfw, /etc/samba, and /etc/sfw/samba. If the system has Samba installed in non-standard locations, also check the smb.conf in those locations.

Procedure:

# grep -i 'encrypt passwords' /etc/smb.conf /etc/sfw/smb.conf /etc/samba/smb.conf /etc/sfw/samba/smb.conf

If the setting is not present, or not set to yes, this is a finding.

Fix Text (F-24074r3_fix)
Edit the smb.conf file and change the encrypt passwords setting to yes.