APP.3.4 Samba

The IT Operation Department MUST carefully plan and regulate the introduction of a Samba server. Depending on the operational scenario, it MUST define the operating mode of the Samba server and the tasks it will perform. It MUST also define which Samba components and other components are required for these purposes.

If the CTDB (Clustered Trivial Database) solution is to be used, the IT Operation Department MUST design it with care. If Samba is also meant to provide Active Directory (AD) services for Linux and Unix systems, these services MUST be planned carefully and tested. Furthermore, the authentication procedure for AD MUST be designed and implemented carefully. The implementation and the order in which stackable Virtual File System (VFS) modules are executed MUST be designed carefully. This implementation SHOULD be documented.

If IPv6 is to be used under Samba, this MUST also be carefully planned. In addition, whether the integration works without errors MUST be checked in a near-operational test environment.

The IT Operation Department MUST configure the Samba server securely. Among other things, the access control settings MUST be adjusted. The same SHOULD apply to settings that affect the performance of the server.

The IT Operation Department MUST configure Samba to only accept connections from secure hosts and networks. Changes to the configuration SHOULD be documented carefully so that it is possible at any time to determine who made which changes and for what reasons. In such cases, the syntax of the configuration file MUST be checked for correctness after every change.

Additional software modules such as SWAT MUST NOT be installed.

Databases in the Trivial Database (TDB) format SHOULD NOT be stored on a partition that uses ReiserFS as its file system. If a netlogon share is configured, unauthorised users SHOULD NOT be able to modify any files on the share.

The operating system of a Samba server SHOULD support access control lists (ACLs) in connection with the file system used. In addition, it SHOULD be ensured that the file system is integrated with the appropriate parameters.

The default settings of SMB Message Signing SHOULD be maintained unless they are contrary to the existing security policies in the information domain in question.

If a version of Samba is used that cannot map ADS in the New Technology File System (NTFS) and file system objects are to be copied or moved across system boundaries, file system objects SHOULD NOT contain ADS with important information.

The default parameters used by Samba to map DOS attributes to the Unix file system SHOULD NOT be used. Instead, Samba should be configured to save DOS attributes and inheritance flags in extended attributes. Shares SHOULD only be managed via the Samba registry.

In addition, the effective access authorisations for the shares of a Samba server SHOULD be checked regularly.

The operating system of the server SHOULD include a user account with all necessary group memberships for each Windows domain user. If this is not possible, Winbind SHOULD be used to convert domain user names into unique Unix user names. When using Winbind, it SHOULD be ensured that conflicts between local Unix users and domain users are prevented.

Furthermore, the pluggable authentication modules (PAMs) SHOULD be integrated.

If Samba is to be used as a DNS server, this implementation SHOULD be planned carefully and tested in advance. Since Samba supports various AD integration modes, the IT Operation Department SHOULD set the DNS settings in accordance with the Samba application scenario at hand.

If users are managed with LDAP in Samba, the IT Operation Department SHOULD plan and document this configuration carefully. The access authorisations for LDAP SHOULD be controlled by means of ACLs.

The Heimdal Kerberos Key Distribution Center (KDC) implemented by Samba SHOULD be used for authentication. It SHOULD be ensured that the Kerberos configuration file specified by Samba is used. Only secure encryption methods SHOULD be used for Kerberos tickets.

If Kerberos is used for authentication, the central time server SHOULD be installed locally on the Samba server. The NTP service SHOULD be configured so that only authorised clients can request the time.

The IT Operation Department SHOULD ensure that Samba only calls trustworthy external programs that have been checked for malicious functions.

Administrators SHOULD be trained on the specific areas of Samba that are in use—user authentication and rights models for Windows and Unix, for example, but also on ACLs and ADS for NTFS.

All the system components required to recover a Samba server SHOULD be included in the organisation-wide backup concept. The account information of all the back ends in use SHOULD also be considered. In addition, all TDB files should be backed up. Furthermore, the Samba registry SHOULD be backed up if it has been used for shares.

To ensure their security while in transit, data packets SHOULD be encrypted using the methods integrated from SMB version 3.