documentation_complete: true

title: 'Require Client SMB Packet Signing, if using <tt>smbclient</tt>'

description: |-
    To require samba clients running <tt>smbclient</tt> to use
    packet signing, add the following to the <tt>[global]</tt> section
    of the Samba configuration file, <tt>/etc/samba/smb.conf</tt>:
    <pre>client signing = mandatory</pre>
    Requiring samba clients such as <tt>smbclient</tt> to use packet
    signing ensures they can
    only communicate with servers that support packet signing.

rationale: |-
    Packet signing can prevent
    man-in-the-middle attacks which modify SMB packets in
    transit.

severity: unknown

identifiers:
    cce: 26328-5

references:
    srg: SRG-OS-999999
    stigid: RHEL-06-000272

ocil_clause: 'it is not'

ocil: |-
    To verify that Samba clients running smbclient must use packet signing, run the following command:
    <pre>$ grep signing /etc/samba/smb.conf</pre>
    The output should show:
    <pre>client signing = mandatory</pre>
