Paranoid Penguin - Samba Security, Part I
On your Samba server, you're going to need your distribution's packages for Samba's libraries; the Samba dæmons smbd, nmbd and winbindd; the Samba client commands smbclient, smbmount and so forth (which are useful even on servers for testing Samba configurations); and also the Web-based configuration tool SWAT (Figure 1). Naturally, nearly all these things are contained in packages whose names don't correspond neatly with the names of their component dæmons, libraries and so forth, but I give some pointers on those shortly.
First, a word about SWAT, which requires a modest security trade-off for Ubuntu users. Although normally in Ubuntu the user root can't log in directly, Samba requires this to be possible, so you need to set a root password on any Ubuntu box that runs SWAT.
Like so much else about Samba, this is not something I recommend doing on any Internet-facing Ubuntu box. However, SWAT is such a useful and educational tool, I feel pretty confident in stating that in non-Internet-facing environments, the mistakes SWAT will help you avoid probably constitute a bigger threat to system security than SWAT does.
As I mentioned, Samba packages are included in all major Linux distributions. In Debian and its derivatives, such as Ubuntu, you'll want to install the following deb packages: samba, samba-common, samba-doc, smbclient and swat (plus whatever packages you need to satisfy dependencies in any of these).
In SUSE, you'll want to install samba, samba-client, samba-winbind and samba-doc. (SWAT is included with one of these, probably samba.)
In Red Hat Enterprise Linux and its derivatives, you need samba, samba-client, samba-common and samba-swat.
Installing these binary packages should involve installation scripts that put startup scripts, symbolic links and so forth in the correct places for everything to work (at least, after you configure Samba to serve something). Using SWAT is the best way to get up and running quickly—not because it does very much work for you, but because its excellent help system makes it super-convenient to summon the pertinent parts of Samba's various man pages.
There are two SWAT quirks I should mention. First, SWAT must be run by an Internet super-server, such as the old Berkeley inetd or the newer xinetd. Ubuntu configures inetd automatically when you install the swat package, but if your distribution of choice does not, you need a line like this in /etc/inetd.conf:
swat stream tcp nowait.400 root /usr/sbin/tcpd /usr/sbin/swat
Second, to get SWAT's help links to work under SUSE 11.0, you may need to create the following symbolic links while logged in to a terminal window as root:
ln -s /usr/share/doc/packages/samba/htmldocs/manpages ↪/usr/share/samba/swat/help ln -s /usr/share/doc/packages/samba/htmldocs/using_samba ↪/usr/share/samba/swat/help ln -s /usr/share/doc/packages/samba/htmldocs/index.html ↪/usr/share/samba/swat/help ln -s /usr/share/doc/packages/samba/htmldocs/manpages.html ↪/usr/share/samba/swat/help
And with that, we're ready to start configuring our Samba server! Or we would be, if we weren't out of time and space for this month. The links in the Resources section, not to mention SWAT's aforementioned excellent help links, should help you get started before we continue this series in my next column. Until then, be safe!
Christopher R. Hertel's On-Line Book Implementing CIFS, a Comprehensive Source of Information on All Things CIFS/SMB-Related: www.ubiqx.org/cifs
“The Official Samba 3.2.x HOWTO and Reference Guide”: us1.samba.org/samba/docs/man/Samba-HOWTO-Collection
Mick Bauer (firstname.lastname@example.org) is Network Security Architect for one of the US's largest banks. He is the author of the O'Reilly book Linux Server Security, 2nd edition (formerly called Building Secure Servers With Linux), an occasional presenter at information security conferences and composer of the “Network Engineering Polka”.
- Transitioning to Python 3
- Red Hat OpenStack Platform
- Tech Tip: Really Simple HTTP Server with Python
- Stepping into Science
- Linux Journal December 2016
- CORSAIR's Carbide Air 740
- The Tiny Internet Project, Part II
- Radio Free Linux
- A Better Raspberry Pi Streaming Solution
- FutureVault Inc.'s FutureVault