CVE-2017-7494 Samba remote call. How do I know if Samba is running or not on my Ubuntu server?

Question

My servers are Ubuntu. I want to know whether Samba is installed accidentally or not. Is the following command correct?

It seems that Samba isn't installed.

$ samba --version
The program 'samba' is currently not installed. You can install it by typing:

$ ps -ef | grep smb
(empty)

Answer 1

It certainly looks likely it's not installed. Try checking with your package manager as to what's installed as a final check. But I would say it looks like it is not installed.

You could also do a search for the executable by using

find / -executable -name samba

Answer 2

I feel that the other answers, while undoubtedly useful, do not answer exactly what you asked for... that is, whether Samba is running, but either whether Samba was installed at some time (by looking at files on disk, which might be left over) or whether Samba is installed with the system's knowledge, which might not be always the case.

dpkg will not tell you whether Samba is installed; it will tell you whether it was installed using dpkg/apt or not. If you install Samba from scratch via a tarball, for example, the whole Ubuntu installation system will truthfully tell you that it's not aware of Samba ever having been installed... even if Samba is up and running.

To verify that samba is installed you do indeed try to run it:

smbd -V

If installed (even if it is not running), it will report its version.

The same check can be done with the client part of the Samba suite, which is not necessarily installed with the server:

smbclient --version

For the file system support, just in case, you do mount.cifs -V instead. Strictly speaking this is CIFS support, not Samba.

To know whether the Samba program is running, you can either check the running processes of the Samba suite (smbd, nmbd, winbind):

sudo ps waux | grep "[sn]mbd"

This will return either nothing if the program is not running, or a list of the processes part of the Samba suite:

root     23942  0.0  0.3 299100 15176 ?        Ss   May24   0:00 /usr/sbin/smbd -D
root     23943  0.0  0.1 298532  4744 ?        S    May24   0:00 /usr/sbin/smbd -D
root     23944  0.0  0.1 298556  7408 ?        S    May24   0:00 /usr/sbin/smbd -D
root     23946  0.0  0.2 299092  9504 ?        S    May24   0:00 /usr/sbin/smbd -D

Or you can verify whether they're listening to ports:

sudo netstat -nap | grep "[sn]mbd"

This will return nothing if the processes are not running, or it will tell you which ports are they listening to:

tcp        0      0 192.168.2.200:445       0.0.0.0:*               LISTEN      23942/smbd
tcp        0      0 192.168.2.200:139       0.0.0.0:*               LISTEN      23942/smbd

Above, for example, my smbd is listening on ALL (0.0.0.0) remote addresses.

Another way is to check whether anything is listening in Samba's place on TCP ports 139 and 445:

sudo fuser -n tcp 139

This will return either nothing (program not running) or the PID of the running process:

139/tcp:             23942

Answer 3

You can check with $ dpkg -L samba

Answer 4

To check if the package samba is installed on Ubuntu , you can use:

dpkg -s samba | grep Status

To find out all files provided by the package samba:

dpkg -L samba

Using apt:

apt-cache policy samba

Sample output:

samba:
Installed: (none)