LPIC-3 Mixed Environment cheat sheet

Daemons: smbd serves SMB/CIFS on TCP 445 and legacy TCP 139; nmbd answers NetBIOS name queries on UDP 137/138 and builds the browse list; winbindd maps domain accounts to Linux IDs; the samba binary runs the whole AD DC stack in the foreground.

Configuration lives in /etc/samba/smb.conf as a [global] section plus one section per share; parameter names are case-insensitive and both # and ; start comments.

testparm validates the file and prints the paths it loaded; testparm -s prints only non-default settings; testparm -v prints every parameter together with its compiled-in default.

Persistent state: private dir (normally /var/lib/samba/private) holds secrets.tdb, passdb.tdb and the AD databases; lock directory and state directory also default below /var/lib/samba.

Since Samba 4.11 the default is server min protocol = SMB2_02, so SMB1 must be re-enabled explicitly with server min protocol = NT1; the client-side client min protocol still permits NT1.

Local accounts: smbpasswd -a user creates the Samba entry, -x removes it, -d disables it, -e enables it; pdbedit -L lists accounts, pdbedit -Lv shows details, pdbedit -x -u user deletes one.

smbstatus shows PID, user, group, client and share per connection; -b is brief output, -L lists locks, -p shows profile data; smbcontrol smbd reload-config re-reads smb.conf without a restart.

Name resolution follows name resolve order = lmhosts host wins bcast by default; nmblookup -A 192.168.1.10 asks which NetBIOS name belongs to that address.

Logging: log file = /var/log/samba/log.%m writes one file per client; log level 0 is silent, 1 is the default, 2-3 adds useful debugging detail and 10 is extremely verbose.

samba-tool domain provision --realm=EXAMPLE.COM --domain=EXAMPLE --adminpass=... --dns-backend=SAMBA_INTERNAL --server-role=dc creates a DC that serves LDAP, Kerberos, DNS and SMB from the samba process; BIND9_DLZ is the alternative DNS backend.

A member server needs security = ads, realm = EXAMPLE.COM and workgroup = EXAMPLE; join with net ads join -U Administrator and confirm with net ads testjoin.

net ads keytab create writes the machine principals into /etc/krb5.keytab, kerberos method = secrets and keytab keeps password and keytab in step, and net ads changetrustpw renews the machine password.

idmap: one idmap config : range for the AD domain plus a wildcard idmap config * : range; the ranges must not overlap; backends are rid, ad, autorid, tdb and nss.

winbind use default domain = yes strips the DOMAIN\ prefix from names; winbind enum users = no and winbind enum groups = no are the defaults and avoid slow full enumerations.

Kerberos rejects tickets with more than five minutes of clock skew, so every member must run NTP; net time -S dc.example.com queries a domain controller's clock.

Multiple DCs replicate SYSVOL with rsync because DFS-R is not implemented; samba-tool ntacl sysvolreset repairs the SYSVOL ACLs and samba-tool ntacl sysvolcheck reports mismatches without changing anything.

Directory management: samba-tool user create, samba-tool group addmembers, samba-tool domain passwordsettings set --complexity=on --min-pwd-length=8, samba-tool dbcheck --cross-ncs.

Backups: samba-tool domain backup online --targetdir=DIR -U Administrator creates one, and samba-tool domain backup restore --backup-file=FILE --newservername=NAME --targetdir=DIR restores it.

Essential share keys: path, read only (the inverse of writeable / write ok), browseable, guest ok (alias public) and available.

Access lists: valid users, invalid users, read list, write list and admin users; entries may be plain users, @group, +group, DOMAIN\user or expansions such as %U.

Permission mapping: create mask (default 0744), directory mask (default 0755), force create mode, force directory mode, force user, force group and inherit permissions.

[homes] generates a share per user pointing at /home/%U and stays hidden unless browseable is enabled; [printers] needs printable = yes, path = /var/spool/samba and browseable = no.

Substitutions: %U session user, %u user, %G primary group, %H home directory, %S share name, %m client NetBIOS name, %I client IP, %L server name, %D domain, %T date and time.

VFS stacking: vfs objects = acl_xattr recycle full_audit loads modules in order; recycle:repository = .recycle and recycle:keeptree = yes configure the trash; shadow_copy2 presents snapshots as previous versions.

Restriction and hardening: hosts allow / hosts deny filter clients, interfaces plus bind interfaces only = yes limit listening sockets, server signing = mandatory and server smb encrypt = required protect transport.

User shares: net usershare add NAME PATH COMMENT guest-ok|guest-nok stores definitions below usershare path (default /var/lib/samba/usershares), limited by usershare max shares and enabled for guests by usershare allow guests.

include = /etc/samba/smb.conf.%U merges a per-user file into the running configuration, a common way to give individual accounts different share settings.

smbclient //server/share -U DOMAIN/user%password opens an interactive session; -L server lists shares, -N skips the password prompt, -I sets the server address, -m SMB3 caps the dialect and -D dir sets the starting directory.

mount -t cifs //server/share /mnt -o credentials=/root/cifs.creds,uid=1000,gid=1000,vers=3.1.1,seal mounts through the kernel cifs driver provided by the cifs-utils package.

A credentials file holds username=, password= and optional domain= lines; it must be mode 0600 because mount.cifs reads the password in plaintext.

Dialect selection with vers=: 1.0, 2.0, 2.1, 3.0, 3.02 and 3.1.1; the seal option forces SMB3 encryption and fails the mount if the server cannot encrypt.

fstab options _netdev, noauto, nofail and x-systemd.automount prevent boot delays or hangs when the SMB server is unreachable.

Batch work: smbclient //s/share -c 'recurse; prompt; mget *', -T c and -T x for tar create and extract, and !command for a local shell escape.

smbget -R smb://server/share/dir downloads recursively, smbtree -N browses workgroups and servers, and nmblookup -A 10.0.0.5 resolves an address back to a NetBIOS name.

cifscreds add -u alice server stores per-session credentials in the kernel keyring for a mount made with the multiuser option; getcifsacl and setcifsacl read and write NT ACLs on mounted files.

mount -t smbfs is obsolete and replaced by cifs; smbclient negotiates SMB2 or SMB3 by default, while SMB1-only servers need -m NT1 or vers=1.0 on the mount.

Identity integration needs matching NSS and PAM entries: passwd: files sss or files winbind in nsswitch.conf, pam_sss.so or pam_winbind.so in the PAM stack, and pam_mkhomedir.so skel=/etc/skel umask=0077 to create home directories at first login.

SSSD AD domain: id_provider = ad, access_provider = ad, ldap_id_mapping = true derives UIDs from SIDs, cache_credentials = true allows offline logins, and use_fully_qualified_names controls the @domain suffix.

realmd wraps the setup: realm discover example.com lists the realm and its providers, realm join example.com joins and configures SSSD plus /etc/krb5.keytab, realm list shows membership and realm leave removes it.

Diagnostics: sss_cache -E expires the whole cache, sssctl domain-status example.com shows online or offline state, and id [email protected] or getent passwd user confirms name resolution.

Winbind alternative: wbinfo -u and -g enumerate accounts, wbinfo -i user shows the mapped ID, ntlm_auth --username=user --domain=EXAMPLE tests authentication; never run winbind and SSSD for the same domain simultaneously.

NFSv4 Kerberos flavors: sec=krb5 authenticates, krb5i adds integrity, krb5p adds privacy; the client needs a host principal in /etc/krb5.keytab and rpc.gssd running to obtain service tickets.

NFS server side: options come from /etc/exports (rw, sync, root_squash, no_subtree_check, sec=krb5p), exportfs -ra reloads the kernel export table and showmount -e server lists exported paths.

POSIX ACLs: setfacl -m u:alice:rwx file, setfacl -x u:alice file, setfacl -b file, setfacl -d -m g:staff:rx dir for defaults and getfacl to display; Samba stores NT ACLs through vfs objects = acl_xattr.

Kerberos client test: kinit [email protected] obtains a TGT, klist shows it and kvno cifs/server.example.com proves the service principal exists.