Citadel / Controls / SharingPreferences

SharingPreferences Control

What does this control check?

The SharingPreferences control verifies that remote access and file sharing services are disabled on your computer. These services allow other devices to connect to and control your computer over the network.

Important: While sharing services can be convenient, they create security risks by opening network ports and allowing remote connections to your device. If enabled, attackers on the same network (or even the internet) can attempt to exploit these services to gain unauthorized access to your computer, view your files, or control your system remotely. Most users don't need these services enabled for their daily work.

Why is this important?

🎯

Reduced Attack Surface

Every enabled sharing service is a potential entry point for attackers. Disabling unnecessary services reduces the number of ways an attacker can compromise your device.

🔓

Prevents Unauthorized Access

Sharing services can be exploited to gain remote access to your computer, allowing attackers to steal files, install malware, or monitor your activities.

📡

Network Security

On public or untrusted networks, enabled sharing services advertise your device to everyone nearby, making you an easy target for network-based attacks.

How to fix this

Disabling Sharing Services on Windows

Disable Remote Desktop:

  1. Click the Start button and select Settings
  2. Click System
  3. Click Remote Desktop (or search for "Remote Desktop settings")
  4. Toggle Remote Desktop to Off

Disable File and Printer Sharing:

  1. Click the Start button and type Control Panel
  2. Click Network and Sharing Center
  3. Click Change advanced sharing settings on the left
  4. Under each network profile (Private, Guest/Public), select Turn off file and printer sharing
  5. Click Save changes
⚠️ Important notes:
  • If you need to share files, use cloud services approved by your organisation instead (e.g. OneDrive, SharePoint, or Google Drive
  • Contact IT support if you're unsure whether you need these services
  • Some work applications may require specific sharing services - check with IT first

Disabling Sharing Services on macOS

  1. Click the Apple menu in the top-left corner
  2. Select System Settings (or System Preferences on older versions)
  3. Click General and then Sharing (or just Sharing on older versions)
  4. You'll see a list of sharing services on the left side
  5. Ensure all the following services are turned off (toggle switches should be in the off position):
    • Screen Sharing
    • File Sharing
    • Printer Sharing
    • Remote Login
    • Remote Management
    • Remote Apple Events
    • Internet Sharing
    • Bluetooth Sharing
    • Content Caching
  6. Close System Settings when done
⚠️ Important notes:
  • If you need to share files, use approved cloud services approved by your organisation
  • Contact IT support if you're unsure whether you need any of these services
  • Some work applications may require specific sharing services - check with IT first
  • All services should be off unless you have a specific, documented need for them

Disabling sharing services on Linux

Disable whichever of these are active and not required:

sudo systemctl disable --now smbd nmbd samba          # SMB file sharing
sudo systemctl disable --now nfs-kernel-server nfs-server   # NFS file sharing
sudo systemctl disable --now xrdp                     # RDP remote desktop
sudo systemctl disable --now cockpit.socket           # Cockpit remote management

# VNC servers vary by desktop; e.g.:
sudo systemctl disable --now vncserver@:1.service
⚠️ About SSH:
  • Unlike on macOS/Windows desktops, running sshd is often intentional on Linux machines used for remote administration — leaving it enabled is fine if that's how you access this machine
  • If this machine does not need remote SSH access, disable it: sudo systemctl disable --now ssh (Debian/Ubuntu) or sudo systemctl disable --now sshd (Fedora/RHEL)
  • Only disable services you don't actually rely on — check with IT support if you're unsure

Verifying the fix

After disabling sharing services, Citadel will automatically verify this control during its next check.

To verify sharing services are disabled:

  1. Open Settings → System → Remote Desktop
  2. Verify Remote Desktop is Off
  3. Open Control Panel → Network and Sharing Center → Change advanced sharing settings
  4. Verify file and printer sharing is turned off for all network profiles

To verify sharing services are disabled:

  1. Open System Settings → General → Sharing
  2. Review the list of services on the left
  3. All services should show as Off
  4. If any service shows as "On", click it and toggle it off

Tip: A quick way to check is to look for any services with a green dot or "On" indicator.

To verify sharing services are disabled:

systemctl is-active smbd nmbd samba nfs-kernel-server nfs-server xrdp cockpit.socket ssh sshd

Each should report inactive unless you intentionally rely on it (e.g. SSH for remote administration).