Harden SAMBA+

In addition to the usual complexity check, SAMBA+ can check passwords against lists of insecure passwords. SAMBA+ already ships one such list. Setting the smb.conf option "enable password blacklist check = yes" prevents passwords such as "Hello123" or "Password1" from being used. Together with the default settings of the Samba AD password complexity check, this blocks 1,000,000 commonly used passwords.

The changes must always be applied on all AD DCs.

This feature is only available for SAMBA+ in the AD DC role, and therefore only on Linux. It is not available for domain member servers, standalone servers or SAMBA+ AIX.

Enabling the check

In the [global] section of /etc/samba/smb.conf, set the option "enable password blacklist check = yes" and restart the AD DC:

# systemctl restart sernet-samba-ad

Using your own lists

The "password lists" smb.conf option allows additional and custom password lists to be configured. A UTF-8 encoded file is expected, with one password per line. Multiple files can be specified separated by a colon (:):

password lists = /usr/share/samba/password-lists/Pwdb_top-1000000-filtered.txt:/data/password-lists/German_common-password-list.txt

Rebuilding the password database

After the first activation, or when changes have been made to the password lists, Samba reinitializes the new password database after a restart. Depending on the size of the lists this can take some time. Until the database has finished initializing, password changes can take longer. The following command forces this process during operation:

# /usr/share/samba/scripts/check-password-list --force-rebuild

Checking against Have I Been Pwned

In addition to these password lists, passwords can also be checked against the very large Have I Been Pwned (HIBP) database. The check is performed locally, so the database has to be downloaded first. SAMBA+ provides a download tool for this. To use it, first configure the desired path in your smb.conf:

[global]
enable password blacklist check = no
hibp db path = /data/hibpdb

Then call the download script:

# /usr/share/samba/scripts/hibp-downloader.py

If you already have "enable password blacklist check = yes" in operation, leave the "hibp db path" smb.conf option unconfigured at first and keep "enable password blacklist check = yes" active. You can then download the database as follows:

# /usr/share/samba/scripts/hibp-downloader.py /data/hibpdb

To resume a failed download, use the "--skip-existing" option.

In the examples above, the database is created in the directory /data/hibpdb. Please note that the database consists of many small files with a combined size of more than 60 GB.

For security reasons, an incomplete database will result in secure passwords no longer being accepted either.

After a successful download, usage can be enabled in the smb.conf:

[global]
enable password blacklist check = yes
hibp db path = /data/hibpdb

For local tools (samba-tool user setpassword) the change is active immediately. For the change to take effect for the Samba service as well, you have to restart the sernet-samba-ad service once:

# systemctl restart sernet-samba-ad