STIGQter STIGQter: STIG Summary: Oracle Linux 6 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The system must use SMB client signing for connecting to samba servers using mount.cifs.

DISA Rule

SV-209011r603263_rule

Vulnerability Number

V-209011

Group Title

SRG-OS-000480

Rule Version

OL6-00-000273

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

Require packet signing of clients who mount Samba shares using the "mount.cifs" program (e.g., those who specify shares in "/etc/fstab"). To do so, ensure signing options (either "sec=krb5i" or "sec=ntlmv2i") are used.

See the "mount.cifs(8)" man page for more information. A Samba client should only communicate with servers who can support SMB packet signing.

Check Contents

If Samba is not in use, this is not applicable.

To verify that Samba clients using mount.cifs must use packet signing, run the following command:

# grep sec /etc/fstab /etc/mtab

The output should show either "krb5i" or "ntlmv2i" in use.
If it does not, this is a finding.

Vulnerability Number

V-209011

Documentable

False

Rule Version

OL6-00-000273

Severity Override Guidance

If Samba is not in use, this is not applicable.

To verify that Samba clients using mount.cifs must use packet signing, run the following command:

# grep sec /etc/fstab /etc/mtab

The output should show either "krb5i" or "ntlmv2i" in use.
If it does not, this is a finding.

Check Content Reference

M

Target Key

2928

Comments