Samba smbnull account

[RJA]

On all but one of my servers, the account smbnull has this entry in the /tcb/fles/auth/s/smbnull file:

:u_pwd=*:\

Does this just mean that the account is disabled?

The other server has the following entry:

:u_pwd=:\

This is being flagged by the security team as negative due to a null passwd. Can I just change this to:

:u_pwd=*:\

Thanks

[Aussan]

u_pwd=*:\ is setting the password to *, which means it's locked, but for smbnull it should be * as you are not using the smbnull to login

[Marco A.]

The :u_pwd=:\ means that the user has not password, the * means that for the security level you are using the /etc/shadow file , you need to check the /etc/shadow of the system in which appears in blank, if you see the encrypted password for that user, then you can put an * right there without any issues.

Regards

[Steven E. Protter]

Shalom,

This user must remain for samba to function. It has no rights and probably can't even log in.

SEP

[Aussan · Accepted solution]

Marco the * for Shadow password is in /etc/passwd

this is the trusted system user security file in /tcb/files/auth/s/smbnull

the * in this case means account is locked

smbnull is a guest account, it's needed to make samba work, but not needed to login. as long as the account is there then it's ok,

[IT Response]

Yes, you are right with that!

[RJA]

Thanks all for the replies ..