Disable Samba
Ensures the Samba file-sharing service (smb.service / smbd) is neither enabled at boot nor running, unless the host is intentionally a Windows-style file server.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Samba (smbd) implements the SMB/CIFS file-sharing protocol over ports 139 and 445. SMB has a long history of severe, widely-exploited vulnerabilities (e.g. EternalBlue / MS17-010) and is a prime lateral-movement and ransomware vector inside networks. Running it where no Windows-style file sharing is needed needlessly exposes a high-value, frequently-targeted service. If the host is not a Samba file server, the service should be stopped and disabled to remove that exposure.
What Pavois checks
Pavois reads the effective state of smb.service from systemd, asserting it is neither enabled nor running. This reflects what is actually listening on 139/445 rather than whether /etc/samba/smb.conf happens to exist. On Debian/Ubuntu the unit may also be named smbd.service; auditing the resolved systemd state avoids guessing from package or config presence and catches drop-in overrides.
describe service('smbd.service') do
it { should_not be_enabled }
it { should_not be_running }
endHow to verify it is applied
Run systemctl is-enabled smb.service (or smbd.service) and systemctl is-active smb.service; expect disabled/masked and inactive. Confirm nothing listens with ss -tlnp | grep -E ':139|:445'.
Inspect & investigate
Inspect journalctl -u smb.service -u smbd.service for start/stop and connection events. systemctl show smb.service -p ActiveState -p UnitFileState gives the machine-readable state. Confirm the SMB ports are closed with ss -tlnp | grep -E ':139|:445'.
Remediation
Pavois's harden plan acts on the service resource named smb with actions disable then stop: it removes boot enablement and stops smbd. Applied with pavois harden apply. Existing shares and config under /etc/samba/ are left in place, only the running service is affected.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | disable, stop |
|---|---|
| name | smbd.service |
| resource | service |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disabling Samba breaks all SMB/CIFS file shares served by this host: Windows/macOS/Linux clients mounting \\host\share or //host/share will lose access, and any print sharing via Samba stops. Before applying: confirm no clients rely on shares from this host (smbstatus lists active sessions/locks), and that it is not a domain member providing winbind-backed services. If the host is a file server, exclude this rule. Note that disabling smb does not by itself disable nmbd (NetBIOS), handle that separately if required.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.14 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.