IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
settings ssl require clientcert = yes and ssl require servercert = yes, also ssl
CA certDir = or ssl CA certFile = . For every client on which
an SSL proxy is used, the key pair and the certificate for that client must be
copied to a protected directory. The paths of these files and the name of the
SAMBA server are sent to the SSL proxy on start-up as parameters. The
clients can now call up the desired SMB/CIFS services from the relevant SSL
proxy. The proxy forwards the requests - protected through the SSL protocol
- to the actual SAMBA server. As a result, as far as the clients are concerned,
the services appear to be provided by the SSL proxy rather than by the
SAMBA server.
If there are compelling reasons why plaintext passwords have to be used, this
can be enforced on clients which run under the operating systems
Windows 9x, Windows NT 4.0 and Windows 2000 through particular
Registry entries. For example, this is necessary under Windows NT 4.0 with
Service Pack 3 or higher, as unless the Registry entries are modified this
version of the operating system also refuses to transmit plaintext passwords
even if the server does not support encrypted passwords. Otherwise the client
may be unable to log on successfully to the server. However, it should be
noted that where plaintext passwords are used, additional protective measures
(e.g. VPN or SSL) are needed for the communications links in every case.
Even once the Registry has been modified, it may be difficult for a
Windows NT 4.0 client to log on to the server using a plaintext password, as
in this case the user is asked to enter his password every time he wishes to
establish a connection, and where different resources are used on the server
this can be very annoying. This is another reason why, if possible, the use of
plaintext passwords should be avoided completely.
Further recommendations regarding the secure configuration of clients will be
found in safeguard S 5.38 Secure Integration of DOS PC's into a UNIX
Network and in the modules 5.5 "PC under Windows NT" and 5.6 "PC with
Windows 95".
Additional controls:
- Are changes in the SAMBA configuration documented and tested in actual
operation prior to use?
- Are encrypted passwords used?
- Are write accesses to the share [netlogon] prohibited?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000