Rule ID
SV-46138r1_rule
Version
V1R12
CCIs
If the permissions of the "smbpasswd" file are too permissive, it may be maliciously accessed or modified, potentially resulting in the compromise of Samba accounts.
Check the permissions of the Samba password files. Procedure: # ls -lL /etc/samba/passdb.tdb /etc/samba/secrets.tdb If the permissions include a '+', the file has an extended ACL. If the file has an extended ACL and it has not been documented with the IAO, this is a finding.
Remove the extended ACL from the file. # setfacl --remove-all /etc/samba/passdb.tdb /etc/samba/secrets.tdb