How to disable CIFS Null Login sessions

up vote
0
down vote

favorite

I scanned my servers on vulnerabilities recently and some ubuntu servers have following issue: CIFS NULL Session Permitted

Description:
NULL sessions allow anonymous users to establish unauthenticated CIFS sessions with Windows or third-party CIFS implementations such as http://www.samba.org or the http://www.opensolaris.org/os/project/cifs-server/ . These anonymous users may be able to enumerate local users, groups, servers, shares, domains, domain policies, and may be able to access various MSRPC services through RPC function calls. These services have been historically affected by numerous vulnerabilities.

Which settings do I need to set in my smb.conf file to solve this issue?

asked Apr 30 at 6:59

Lumpi

add a commentÂ |Â

up vote
0
down vote

favorite

I scanned my servers on vulnerabilities recently and some ubuntu servers have following issue: CIFS NULL Session Permitted

Which settings do I need to set in my smb.conf file to solve this issue?

asked Apr 30 at 6:59

Lumpi

add a commentÂ |Â

up vote
0
down vote

favorite

I scanned my servers on vulnerabilities recently and some ubuntu servers have following issue: CIFS NULL Session Permitted

Which settings do I need to set in my smb.conf file to solve this issue?

asked Apr 30 at 6:59

Lumpi

I scanned my servers on vulnerabilities recently and some ubuntu servers have following issue: CIFS NULL Session Permitted

Which settings do I need to set in my smb.conf file to solve this issue?

asked Apr 30 at 6:59

Lumpi

asked Apr 30 at 6:59

Lumpi

asked Apr 30 at 6:59

Lumpi

asked Apr 30 at 6:59

Lumpi

add a commentÂ |Â

1 Answer
1

active

oldest

votes

up vote
0
down vote

In smb.conf, this is what I did:

I added / changed these lines to

map to guest = Never # Disables any login with a non-user
 restrict anonymous = 2 # Disables recon potential 
usershare allow guests = no # Not sure exactly what this does, but looked like a good one to set to no

Then, I also changed any guest_ok lines to no

guest ok = no

answered Jul 31 at 22:03

user7133679

Oh right, haha, then do service smbd restart Then, the vulnerability scanner did not detect the issue anymore. Another way to manually test is to use the net command from windows to try and do a null session. As far as I can tell, the scanner is looking to see if it can do that or login. dummies.com/programming/networking/â€¦
â€“Â user7133679
Aug 1 at 18:49

add a commentÂ |Â

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "89"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: false,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);

);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');

var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);

;
$window.on('scroll', onScroll);

);

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1029978%2fhow-to-disable-cifs-null-login-sessions%23new-answer', 'question_page');

);

Post as a guest

Name

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

up vote
0
down vote

In smb.conf, this is what I did:

I added / changed these lines to

map to guest = Never # Disables any login with a non-user
 restrict anonymous = 2 # Disables recon potential 
usershare allow guests = no # Not sure exactly what this does, but looked like a good one to set to no

Then, I also changed any guest_ok lines to no

guest ok = no

answered Jul 31 at 22:03

user7133679

Oh right, haha, then do service smbd restart Then, the vulnerability scanner did not detect the issue anymore. Another way to manually test is to use the net command from windows to try and do a null session. As far as I can tell, the scanner is looking to see if it can do that or login. dummies.com/programming/networking/â€¦
â€“Â user7133679
Aug 1 at 18:49

add a commentÂ |Â

up vote
0
down vote

In smb.conf, this is what I did:

I added / changed these lines to

map to guest = Never # Disables any login with a non-user
 restrict anonymous = 2 # Disables recon potential 
usershare allow guests = no # Not sure exactly what this does, but looked like a good one to set to no

Then, I also changed any guest_ok lines to no

guest ok = no

answered Jul 31 at 22:03

user7133679

Oh right, haha, then do service smbd restart Then, the vulnerability scanner did not detect the issue anymore. Another way to manually test is to use the net command from windows to try and do a null session. As far as I can tell, the scanner is looking to see if it can do that or login. dummies.com/programming/networking/â€¦
â€“Â user7133679
Aug 1 at 18:49

add a commentÂ |Â

up vote
0
down vote

In smb.conf, this is what I did:

I added / changed these lines to

map to guest = Never # Disables any login with a non-user
 restrict anonymous = 2 # Disables recon potential 
usershare allow guests = no # Not sure exactly what this does, but looked like a good one to set to no

Then, I also changed any guest_ok lines to no

guest ok = no

answered Jul 31 at 22:03

user7133679

In smb.conf, this is what I did:

I added / changed these lines to

map to guest = Never # Disables any login with a non-user
 restrict anonymous = 2 # Disables recon potential 
usershare allow guests = no # Not sure exactly what this does, but looked like a good one to set to no

Then, I also changed any guest_ok lines to no

guest ok = no

answered Jul 31 at 22:03

user7133679

answered Jul 31 at 22:03

user7133679

answered Jul 31 at 22:03

user7133679

answered Jul 31 at 22:03

user7133679

Oh right, haha, then do service smbd restart Then, the vulnerability scanner did not detect the issue anymore. Another way to manually test is to use the net command from windows to try and do a null session. As far as I can tell, the scanner is looking to see if it can do that or login. dummies.com/programming/networking/â€¦
â€“Â user7133679
Aug 1 at 18:49

add a commentÂ |Â

Oh right, haha, then do service smbd restart Then, the vulnerability scanner did not detect the issue anymore. Another way to manually test is to use the net command from windows to try and do a null session. As far as I can tell, the scanner is looking to see if it can do that or login. dummies.com/programming/networking/â€¦
â€“Â user7133679
Aug 1 at 18:49

Oh right, haha, then do service smbd restart Then, the vulnerability scanner did not detect the issue anymore. Another way to manually test is to use the net command from windows to try and do a null session. As far as I can tell, the scanner is looking to see if it can do that or login. dummies.com/programming/networking/â€¦
â€“Â user7133679
Aug 1 at 18:49

add a commentÂ |Â

draft saved

draft discarded

draft saved

draft discarded

Sign up or log in

Post as a guest

Name

Sign up or log in

Name

搜尋此網誌

Gfilui