Uninstall the Samba Package
Ensures the samba package (SMB/CIFS smbd/nmbd services) is not installed when not required.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The samba package runs the smbd/nmbd services that implement SMB/CIFS file and printer sharing. SMB has a long history of serious vulnerabilities (e.g. the EternalBlue class) and exposes a network listener. On a system that does not need to serve Windows file shares, removing Samba eliminates that exposed service and provides a safeguard against its accidental activation.
What Pavois checks
Pavois queries the package database with describe package('samba') and asserts it should_not be_installed, reflecting the real installed state instead of inferring presence from a config file that may exist without the daemon.
describe package('samba') do
it { should_not be_installed }
endHow to verify it is applied
Debian/Ubuntu: dpkg -s samba → package 'samba' is not installed. RPM: rpm -q samba → package samba is not installed. Confirm no SMB listener with ss -ltnp | grep -E ':445|:139' (no output).
Inspect & investigate
Removal is logged in /var/log/dpkg.log (Debian/Ubuntu) or dnf history / /var/log/dnf.rpm.log (RPM). Samba service activity, if it ran, appears via journalctl -u smbd -u nmbd. Confirm state with dpkg -l samba / rpm -q samba.
Remediation
Pavois's harden plan removes the samba package (resource package, action remove). Apply it with pavois harden apply. This uninstalls the smbd/nmbd services.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | samba |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing Samba stops all SMB/CIFS file and printer sharing this host provides. Before applying, confirm no clients (Windows machines, other servers, backup tools) mount shares from this server. This rule targets the Samba server; client mounts via cifs-utils are unaffected. Migrate or retire dependent shares before removal.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.14, 2.1.6 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.