- Linux
- Samba
- Security
Running Samba in a security hardened environment
Comparing apples and oranges
… or Samba vs Windows, if you want.
Here is a nice table of the most commonly implemented security policies that you can find in an AD DS environment where the suggestions from the Microsoft Compliance Toolkit were applied.
The last column compares the security default of Windows Server 2022 vs Samba 4.21. As you can see, there is no clear winner in this race; Samba tracks Windows very close also in the security department!
Truth be said, most of the AD DS environments dating back from the early 2000s that never made any conscious security effort (meaning they were just upgraded at every version of Windows), are far less secure than a recent default Samba install!
It’s very common to see AD DS production environments living into 2025 with NTLM v1 or RC4 Kerberos session keys.
| Windows GPO Settings | Windows GPO Default Value | Windows GPO Hardened Value | Samba Settings | Samba Default Value | Samba Hardened Value | Notes | Winner |
|---|---|---|---|---|---|---|---|
| Restrict Unauthenticated RPC clients | None | Authenticated | allow dcerpc auth level connect (G) | no | yes | Draw | |
| Configure SMB v1 Server | Feature not installed | No effect | server min protocol (G) | SMB2_02 | SMB2_10 | By default SMB2 selects the SMB2_10 variant. | Draw |
| NetBT NodeType configuration | B-Node | P-Node | name resolve order (G) | lmhosts wins host bcast | lmhosts wins host bcast | Samba already prefers DNS (host) method | Samba |
| Network access: Restrict anonymous access to Named Pipes and Shares | Enabled | Enabled | restrict anonymous (G) | restrict anonymous = 0 | restrict anonymous = 2 | Windows | |
| Enable insecure guest logon | Enabled | Disabled | guest ok (S) | guest ok = no | guest ok = no | Samba already restricts guests for shares by default | Samba |
| Domain member: Digitally encrypt or sign secure channel data (always) | Enabled | Enabled | client schannel (G) | client schannel = yes | client schannel = yes | Draw | |
| Domain member: Require strong (Windows 2000 or later) session key | Enabled | Enabled | require strong key (G) | yes | yes | Draw | |
| Microsoft network client: Digitally sign communications (always) | Disabled | Enabled | client signing (G) | default (desired) | required | Draw | |
| Microsoft network client: Digitally sign communications (always) | Disabled | Enabled | client ipc signing (G) | default (required) | required | Possibly Samba; not clear winner as some endpoints could be hard-coded. | |
| Microsoft network server: Digitally sign communications (always) | DC= Required; member=disabled | DC= Required; member=disabled | server signing (G) | default (DC=required; member=disabled) | mandatory | Draw | |
| Network access: Allow anonymous SID/name translation | Disabled | Disabled | restrict anonymous = 0 | restrict anonymous = 2 | Possibly Windows | ||
| Network access: Do not allow anonymous enumeration of SAM accounts | Disabled | Enabled | restrict anonymous = 0 | restrict anonymous = 2 | Windows | ||
| Network access: Do not allow anonymous enumeration of SAM accounts and shares | Enabled | Enabled | restrict anonymous = 0 | restrict anonymous = 2 | Draw | ||
| Network security: Configure encryption types allowed for Kerberos | RC4, AES128, AES256 | AES128,AES256 | kerberos encryption types (G) | all | strong | Draw | |
| Network security: Do not store LAN Manager hash value on next password change | Enabled | Enabled | lanman auth (G) | no | no | Draw | |
| Network security: LAN Manager authentication level | Send NTLMv2 Response Only | Send NTLMv2 Response Only | ntlm auth (G) | ntlmv2-only | ntlmv2-only | Draw | |
| Network security: Minimum session security for NTLM SSP based (including secure RPC) clients | Require 128 Bit Encryption | Require NTLMv2; Require 128 Bit Encryption | client use spnego (G) | yes | yes | Draw | |
| Network security: Minimum session security for NTLM SSP based (including secure RPC) servers | Require 128 Bit Encryption | Require NTLMv2; Require 128 Bit Encryption | raw NTLMv2 auth | no | no | Draw | |
| Microsoft network client: Send unencrypted password to connect to third-party SMB servers | Disabled | Disabled | encrypt passwords (G) | yes | yes | Draw | |
| disable netbios (G) | no | yes | nmbd service is disabled by default | Samba, because it does not start NetBIOS by default. |
I just want the config
For the lazy, here is the relevant configuration you can put into smb.conf if you want your Samba install to respect the same security directives as an hardened AD DS environment.
Don’t blame me if you blindly apply it and things stop working.
; security settings
allow dcerpc auth level connect = yes
server min protocol = SMB2_10
restrict anonymous = 2
client signing = required
client ipc signing = required
disable netbios = yes
kerberos encryption types = strong
server signing = mandatory