# Ensure samba file server services are not in use

Necessity: The Samba service implements the SMB/CIFS protocol for network file sharing. This protocol has historically been a target for significant security vulnerabilities, such as those exploited by worms like WannaCry and NotPetya. Running unnecessary services like Samba dramatically increases the system's attack surface. If the server's role does not explicitly require it to act as a file server, the service should be removed to prevent potential exploitation and unauthorized access to the file system.

Auditing and Remediation: The audit script first verifies if the 'samba' package is installed. If it is, the script then determines if the 'smb' service is enabled to start at boot. The remediation script provides two options: disabling the service, which stops it from running and prevents it from starting on boot, or uninstalling the package, which completely removes the software from the system.

Recommended State Rationale:
- Basic: ['Disabled'] - The minimum acceptable security posture is to have the service disabled. This prevents it from being an active listening service on the network but leaves the software binaries on the disk, which could potentially be exploited by a local attacker.
- Moderate: ['Not Installed'] - A more secure posture is to completely remove the package. This adheres to the principle of least functionality, ensuring that the vulnerable software is not present on the system at all.
- Strict: ['Not Installed'] - The most secure and highly recommended state is to have the Samba package uninstalled. For any system not explicitly designated as a file server, there is no justification for the software to be present. This completely eliminates the attack surface associated with Samba.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks for the Samba service. If the 'samba' package is not installed (checked via 'rpm -q samba'), the script must output 'Not Installed'. If it is installed, the script must use 'systemctl is-enabled smb' to check the service status and output either 'enabled' or 'disabled'. The script must only return one of these three exact string values.

## Remediation Script Working

Bash script that accepts a single positional command-line argument: 'disable' or 'uninstall'. If the argument is 'disable', the script must execute 'systemctl --now disable smb'. If the argument is 'uninstall', it must execute 'yum -y remove samba'. The script must return 'true' if the command succeeds and 'false' if it fails.

