Skip to content
Log In

Disable Samba

An XCCDF Rule

Description

The smb service can be disabled with the following command: 
$ sudo systemctl mask --now smb.service

Rationale

Running a Samba server provides a network-based avenue of attack, and should be disabled if not needed.

ID
xccdf_org.ssgproject.content_rule_service_smb_disabled
Severity
Low
References
Updated

Remediation Templates

A Puppet Snippet

include disable_smb
class disable_smb {
  service {'smb':
    enable => false,
    ensure => 'stopped',
  }
}

A Shell Script

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel-default; then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'smb.service'
"$SYSTEMCTL_EXEC" disable 'smb.service'
"$SYSTEMCTL_EXEC" mask 'smb.service'

OS Build Blueprint

[customizations.services]
masked = ["smb"]

An Ansible Snippet

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-92250-0
  - disable_strategy