Hi-
In having a Foundstone scan done on the NetSUS appliance so that it could be used centrally for internal SUS duty, a few things stuck out. They were mainly around vulnerabilities with SMB. As the instance I was having scanned was only going to be used for SUS, I didn't need SMB turned on, so I turned it off.
Unfortunately smbd is controlled by Upstart, which can be a little hard to understand. Upstart is event driven, rather than run level driven. Here's the beginning of the /etc/init/smbd.conf file:
start on local-filesystem
stop on runlevel [!2345]Basically, it's going to startup smbd whenever the local filesystem is mounted and stop when the runlevel is not (!) 2,3,4 or 5. Totally not what we want. We want it off, all the time, with the ability to still do a
service smbd startSo instead, we can do this:
start on [!0123456]We're basically telling Upstart to begin smbd when the runlevel is NOT 0,1,2,3,4,5 or 6. Which is... NEVER!
Just thought this may help someone as I was scratching my head for about a day trying to configure service runlevels and smbd not paying attention to that config.
