documentation_complete: true

title: 'Disable Root Access to SMB Shares'

description: |-
    Administrators should not use administrator accounts to access
    Samba file and printer shares. Disable the root user and the wheel
    administrator group:
    <pre>[<i>share</i>]
      invalid users = root @wheel</pre>
    If administrator accounts cannot be disabled, ensure that local system
    passwords and Samba service passwords do not match.

rationale: |-
    Typically, administrator access is required when Samba must create user and
    system accounts and shares. Domain member servers and standalone servers may
    not need administrator access at all. If that is the case, add the invalid
    users parameter to <tt>[global]</tt> instead.

severity: unknown

identifiers:
    cce: 27533-9
