UCF STIG Viewer Logo

The system must use SMB client signing for connecting to samba servers using smbclient.


Finding ID Version Rule ID IA Controls Severity
V-218024 RHEL-06-000272 SV-218024r505923_rule Low
Packet signing can prevent man-in-the-middle attacks which modify SMB packets in transit.
Red Hat Enterprise Linux 6 Security Technical Implementation Guide 2020-09-03


Check Text ( C-19505r377087_chk )
To verify that Samba clients running smbclient must use packet signing, run the following command:

# grep signing /etc/samba/smb.conf

The output should show:

client signing = mandatory

If it is not, this is a finding.
Fix Text (F-19503r377088_fix)
To require samba clients running "smbclient" to use packet signing, add the following to the "[global]" section of the Samba configuration file in "/etc/samba/smb.conf":

client signing = mandatory

Requiring samba clients such as "smbclient" to use packet signing ensures they can only communicate with servers that support packet signing.