IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
Web Administration Tool (SWAT) which is supplied as standard with the
SAMBA package.
SAMBA currently offers four different means of achieving client
authentication. With the setting security = user, the SAMBA server checks
whether the client is transmitting a valid combination of user ID and
password. With security = server or security = domain it leaves this check to
one or more other SMB/CIFS servers which it trusts and are specified via the
parameter password server. On the other hand, if security = share is set, only
a simple password check is performed and the client does not have to transmit
any user ID. This procedure is considerably weaker than authentication via
user ID and password and should only be used if the data on the SAMBA
server does not have to be protected. An example here might be a server with
write-protected data medium and data that can be accessed by the public. In
this case it is appropriate not to have any authentication, and the easiest way
of implementing this is via the setting security = share.
Either plaintext passwords or encrypted passwords can be used for client
authentication. As plaintext passwords can easily be intercepted during their
transportation over the network using freely accessible tools, in principle only
encrypted passwords should be used. On the client side, encrypted passwords
are supported e.g. by Windows 95 (with installed SMB update), Windows 98,
Windows NT 4.0 and Windows 2000. In file smb.conf on the SAMBA server,
encrypted passwords are activated by the parameter encrypt passwords = yes.
Unlike plaintext passwords, a SAMBA server cannot check encrypted
passwords with the authentication mechanisms of the underlying UNIX
operating system (which, for example, references /etc/passwd or /etc/shadow).
It is therefore necessary to have an additional password file, which is specified
via the parameter smb passwd file. This file contains the encrypted passwords
and must be carefully protected from unauthorised access.
The rights of a user to access directories and files via SAMBA are derived
partly from the settings in file smb.conf and partly from the access rights of
the file system on which the shared data is held. Here too careful configuration
is necessary to ensure that access rights are granted in a consistent manner.
Unlike on Windows NT servers with NTFS drives, when SAMBA is used it is
not always appropriate to grant access rights exclusively through the file
system. The reason for this is that commonly used UNIX file systems
implement a different security model, based on permissions and ownership,
than NTFS. Depending on the specific application, it is therefore necessary to
check whether certain superordinate access restrictions can be better
configured through file smb.conf. Reference is made here to the parameters
(in)valid users and read/write list.
The following parameters can potentially allow access restrictions to be
circumvented:
admin users
force group / group
force user
guest account
hosts equiv
username / users / user
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000