* Tue Nov 12 2024 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-7.sme

- disable access to list of users without being logged in [SME: 12765]

root/etc/e-smith/templates/etc/smb.conf/11anonymous

@@ -0,0 +1,8 @@
+{
+# 0 allows to retrieve the list of users without being logged on the domain 
+# 1 will disable anonymous SAMR access.
+# 2 will, in addition to restricting SAMR access, disallow anonymous connections to the IPC$ share in general.
+# The option also affects the browse option which is required by legacy clients which rely on Netbios browsing. 
+# While modern Windows version should be fine with restricting the access there could still be applications relying on anonymous access.
+}
+restrict anonymous = 2

smeserver-samba.spec

@@ -4,7 +4,7 @@ Summary: smeserver specific Samba configuration files and templates
 %define name smeserver-samba
 Name: %{name}
 %define version 11.0.0
-%define release 6
+%define release 7
 Version: %{version}
 Release: %{release}%{?dist}
 License: GPL
@@ -41,6 +41,9 @@ Requires: /usr/bin/tdbbackup
 AutoReqProv: no
 
 %changelog
+* Tue Nov 12 2024 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-7.sme
+- disable access to list of users without being logged in [SME: 12765]
+
 * Tue Aug 13 2024 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-6.sme
 - use esmith::util::ldap for machines LDAP account [SME: 12687]