Access (BYO or 3340) 57608 : SMB Signing not required

Problem

In security Scanning customer finds "57608 : Signing is not required on the remote SMB server."

security violation : 57608 : SMB Signing not required

Error Message

57608 : SMB Signing not required

Signing is not required on the remote SMB server. An unauthenticated, remote attacker can exploit this to conduct man-in-the-middle attacks against the SMB server.

Cause

Enforce message signing in the host's configuration. On Windows, this is found in the policy setting 'Microsoft network server: Digitally sign communications (always)'. On Samba, the setting is called 'server signing'.

Solution

Follow below steps to remediate the issue.

Steps :

1) Stop the CIFS server using clish (CIFS> server stop)

2) Add below line in /opt/VRTSnas/conf/smbglobal.conf file on both the nodes

server signing ='mandatory'
        
3) Start the CIFS server using clish (CIFS> server start)

4) Verify if the entry is present in the /etc/samba/smb,conf file on both the nodes

# cat /etc/samba/smb.conf | grep signing

5) Run Security Scan and verify if the issue is fixed.