IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
username map
If any of these parameters are used, the possible security implications should
therefore be carefully examined.
Symbolic links in shared directories can have the result of giving clients
unauthorised access to files outside of the shared area. It is recommended that
this is prevented by setting the parameter wide links = no. However, it should
be noted that this parameter can slow down throughput as the extra checks
required use up some of the processor capacity. If this could result in
operations being hampered, one could try setting the parameter getwd cache =
yes. As an alternative to checking symbolic links, consideration should be
given to using the parameter root directory = . This setting prevents
access to directories and files outside of . However, all the files needed
to run SAMBA, including the password files, must then be copied to
subdirectories of , including the password files.
Amongst other things, logon scripts for clients can be provided on the server
via the share [netlogon]. Under no circumstances should users be able to
modify files in this share. It is recommended that writeable = no and guest
ok = no or that equivalent parameters are set for this share.
The following parameters are preconfigured and should not be altered as this
might impair proper and secure operation of IT systems.
kernel oplocks =
locking = yes
magic [...] =
map to guest = Never
passwd chat debug = no
password level = 0
share modes = yes
use rhosts = no
If the services of a SAMBA server are used over larger networks which are
not completely under the organisation's own control, consideration should be
given to protecting the communications links through the use of cryptographic
procedures. This is especially recommended if there are compelling reasons as
to why plaintext passwords have to be used. Protection can be provided
through appropriate hardware or software components. SAMBA provides
special support for the use of SSL. To avail oneself of this possibility, an SSL
software package, normally the freeware SSLeay software, must be installed
on the SAMBA server. On the client side, a SSL proxy software package is
needed; this is available free of charge for Windows NT and UNIX clients.
Windows 9x clients can use the SSL proxy of a Windows NT or UNIX client
in their subnetwork. The first steps of configuration involve defining a
Certification Authority (CA) and generating key pairs and certificates for the
server and clients (assuming this has not already been done). The
corresponding procedures are explained in the documentation for SSLeay. To
activate SSL on the SAMBA server, as a minimum the parameters ssl = yes
and ssl server cert = should be set in file smb.conf. If the private key
of the server is not stored in the same file as the server certificate, the
parameter ssl server key = is necessary as well. It is recommended
enabling checking of server and client certificates. This requires the parameter
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000