3

I'm configuring a debian 10 VPS and recently installed samba. I was impressed -- in a bad way :) -- about how quickly /var/log/samba started filling up with all sorts of attempts to access the one share I'd set up.

Seeking to harden my setup I did some online research and made a number of changes to /etc/samba/smb.conf:

  • log level = 3
  • map to guest server = never
  • restrict anonymous = 2

This appears to have frustrated attackers. But I'm not skilled at reading the samba log files so I'm not sure.

By watching the log files being recorded for the access attempts I believe the changes are causing the attackers to give up. I say that because all the log files are about the same size, and all end after a log event like this:

[2021/11/20 18:01:59.454538, 3] ../auth/auth_log.c:610(log_authentication_event_human_readable) Auth: [SMB,(null)] user [][] at [Sat, 20 Nov 2021 18:01:59.454490 UTC] with [No-Password] status [NT_STATUS_OK] workstation [] remote host [ipv4:61.184.77.182:56818] became [HWSRV-901112][nobody] [S-1-5-21-4219689906-1908890436-3181349475-501]. local host [ipv4:104.168.220.233:445] {"timestamp": "2021-11-20T18:01:59.454714+0000", "type": "Authentication", "Authentication": {"version": {"major": 1, "minor": 0}, "status": "NT_STATUS_OK", "localAddress": "ipv4:104.168.220.233:445", "remoteAddress": "ipv4:61.184.77.182:56818", "serviceDescription": "SMB", "authDescription": null, "clientDomain": "", "clientAccount": "", "workstation": "", "becameAccount": "nobody", "becameDomain": "HWSRV-901112", "becameSid": "S-1-5-21-4219689906-1908890436-3181349475-501", "mappedAccount": "", "mappedDomain": "", "netlogonComputer": null, "netlogonTrustAccount": null, "netlogonNegotiateFlags": "0x00000000", "netlogonSecureChannelType": 0, "netlogonTrustAccountSid": null, "passwordType": "No-Password", "duration": 1587}}

However, what concerns me is that last entry is immediately preceded by ones that look like this:

[2021/11/20 18:01:59.454449, 3] ../source3/auth/auth.c:256(auth_check_ntlm_password) auth_check_ntlm_password: anonymous authentication for user [] succeeded

I don't know samba but having anonymous authentication succeed is troubling.

What else should I do to harden my installation? I can add some firewall rules to block access from all except certain IP addresses. But that will interfere with attempts to access the share when I'm on traveling.

2
  • 1
    "This appears to have frustrated attackers" have you really put a Samba share out on the Internet? Don't do that! No-one does that! Nov 20, 2021 at 21:47
  • 1
    "I can add some firewall rules [...] But that will interfere with attempts to access the share when I'm on traveling" the usual approach here is to use a VPN, and secure what are intended as internal services so that they are accessible only internally or across the VPN Nov 20, 2021 at 21:48

1 Answer 1

3

Having your Samba/CIFS ports open to the Internet is a very bad practice regardless of your Samba settings. Samba runs under the root user (needs to) and if there are remotely exploitable vulnerabilities it's getting increasingly likely that your entire system will be compromised.

If you absolutely need to access your Samba shares remotely you could

  • Set up a VPN server and allow Samba to listen only on internal/VPN networks
  • Use SSH port forwarding while again either firewalling Samba or making it listen only on certain interfaces
  • Use firewall + knock to only open your ports to trusted users

knock is the simplest to implement and allows to access your device using pretty much any OS.

2
  • 1
    Thanx, particularly for the alternatives. Nov 20, 2021 at 23:37
  • 1
    Thanks for articulating it so clearly +1 Nov 21, 2021 at 8:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .