documentation_complete: true

prodtype: rhel7

title: 'Require Client SMB Packet Signing, if using mount.cifs'

description: |-
    Require packet signing of clients who mount Samba
    shares using the <tt>mount.cifs</tt> program (e.g., those who specify shares
    in <tt>/etc/fstab</tt>). To do so, ensure signing options (either
    <tt>sec=krb5i</tt> or <tt>sec=ntlmv2i</tt>) are used.
    <br /><br />
    See the <tt>mount.cifs(8)</tt> man page for more information. A Samba
    client should only communicate with servers who can support SMB
    packet signing.

rationale: |-
    Packet signing can prevent man-in-the-middle
    attacks which modify SMB packets in transit.

severity: unknown

identifiers:
    cce@rhel7: 80281-9

ocil_clause: 'it does not'

ocil: |-
    To verify that Samba clients using mount.cifs must use packet signing, run the following command:
    <pre>$ grep sec /etc/fstab</pre>
    The output should show either <tt>krb5i</tt> or <tt>ntlmv2i</tt> in use.
