---
title: "HOST-SVC-010 Samba File Server Installed or Enabled"
canonical: https://openvapt.com/checks/HOST-SVC-010.html
html: https://openvapt.com/checks/HOST-SVC-010.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-SVC-010 Samba File Server Installed or Enabled

Checks whether the Samba SMB file server is installed or set to start at boot.

- Domain: Server
- Severity: Low
- Control category: Secure Configuration
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N`
- CIS Controls v8: 4.8
- NIST CSF 2.0: PR.PS-01, PR.IR-01
- CWE: CWE-1188
- NIST SP 800-53 Rev. 5: CM-7, CM-7(1)
- Benchmark topic: Samba is not installed unless required (CIS Controls v8 4.8) (topic only, no benchmark text)

## Why It Matters

SMB file sharing exposes files, printers and authentication to the network and has been the target of worms and several critical remote code execution flaws. It is needed only on file servers for Windows-style clients. If this machine is one of the file servers that legitimately run it, record the reason in the suppression file so the finding stays visible but accepted.

## How It Detects

Reads installed packages from /var/lib/dpkg/status (only entries marked 'install ok installed'; /var/lib/dpkg/info/*.list is a fallback used only when the status file cannot be read) and the allow-listed rpm -qa, and looks for samba. Reads the *.wants links under /etc/systemd/system (and asks the allow-listed systemctl is-enabled) for smbd.service, nmbd.service, smb.service, nmb.service, samba.service. Either an installed package or an enabled unit fails. Incomplete when no package database and no systemd unit directory could be read.

## How to Fix

apt purge samba  or  dnf remove samba , and  systemctl disable --now smbd nmbd  (smb nmb on the RHEL family). Where it is required, disable SMB1, require signing and restrict shares to named users. Before removing a package, check that no application on this machine or the network still uses the service, and keep console access when the service is remote-access related.

## How to Verify

```
dpkg -l samba 2>/dev/null | grep '^ii' ; systemctl is-enabled smbd.service nmbd.service smb.service nmb.service samba.service 2>/dev/null
```

## Learn the Theory

- [P1 Linux Server Hardening](https://openvapt.com/academy/p1.md)
- [P22 Authentication Policy and Package Hygiene](https://openvapt.com/academy/p22.md)

## References

- [NIST SP 800-123, Guide to General Server Security](https://csrc.nist.gov/pubs/sp/800/123/final)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/legacy_services.go

Run it: `openvapt scan --only HOST-SVC-010`. Read it offline: `openvapt explain HOST-SVC-010`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-SVC-010.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.