# Ensure samba file server services are not in use

Necessity: The Samba service provides Server Message Block (SMB) protocol functionality, enabling file and print sharing with Windows systems. If the server is not intended to be a file server in a mixed OS environment, this service presents a significant and unnecessary attack surface. SMB has historically been the target of numerous critical vulnerabilities, such as those exploited by worms like WannaCry and NotPetya. A misconfigured or unpatched Samba service can lead to unauthorized file access, information disclosure, and remote code execution. Auditing and Remediation: The audit script verifies whether the 'samba' package is installed and if its primary service, 'smbd', is enabled. This provides a clear status of its potential use. The remediation script provides two levels of mitigation: disabling the service, which stops it from running but leaves the software on the system, or purging the package, which removes it entirely. Recommended State Rationale: The recommended states are designed to minimize the system's attack surface. Basic: ['Disabled'] represents the minimum acceptable security posture. Disabling the service prevents it from running and accepting connections, but leaves the software installed, which might be desirable if it's needed intermittently. Moderate/Strict: ['Not Installed'] is the most secure state. By completely removing the package, all associated binaries and configuration files are deleted from the system. This eliminates the risk of accidental activation and removes any potential vulnerabilities present in the software, which is the best practice for any service that is not explicitly required for the system's function.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the status of the Samba service. The script should first determine if the 'samba' package is installed. If it is not installed, the script must return the string 'Not Installed'. If the package is installed, the script must then check if the 'smbd' service is active and enabled, returning 'Enabled' if it is, and 'Disabled' if it is not. The script must only output one of these three strings: 'Enabled', 'Disabled', or 'Not Installed'.

## Remediation Script Working

Bash script that accepts a single command-line argument which can be either 'Disabled' or 'Not Installed'. If the argument is 'Disabled', the script must stop and disable the 'smbd' service. If the argument is 'Not Installed', the script must completely purge the 'samba' package and its dependencies from the system. The script must return the string 'true' on successful completion of the requested action and 'false' if it fails.

