LPIC-3 Mixed Environment flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

smbd

Samba daemon that serves SMB/CIFS file and print requests, listening on TCP 445 and legacy TCP 139, and handling authentication, share connections, oplocks and byte-range locking for clients.

nmbd

NetBIOS name service daemon of Samba; it listens on UDP 137 and 138, answers name queries, builds the browse list and can act as a WINS server for legacy clients.

testparm

Samba configuration checker. Without options it validates smb.conf and prints the loaded file paths; -v also shows every parameter together with its compiled-in default value.

TDB files

Samba's memory-mapped database format kept in the private directory: secrets.tdb holds machine and trust secrets, passdb.tdb holds local accounts and registry.tdb holds registry-based configuration.

smbpasswd -a

Adds an existing Unix account to Samba's password database and sets its SMB password; -x removes the entry, -e enables it and -d disables it.

smbstatus

Reports active SMB sessions with PID, user, group, client name and share; -b gives brief output, -L lists locks and -p shows profile statistics.

samba-tool domain provision

Creates a new Samba Active Directory domain and its first domain controller, setting realm, NetBIOS domain name, administrator password and DNS backend, either SAMBA_INTERNAL or BIND9_DLZ.

net ads join

Joins the local host to an Active Directory domain as a member server, creating the machine account on a DC and storing its password locally; net ads testjoin verifies the membership.

security = ads

smb.conf setting for a domain member; users are authenticated against Active Directory via Kerberos, and SID-to-UID and SID-to-GID mapping is done by winbind or SSSD.

idmap config

Parameter block mapping Windows SIDs to Linux UIDs and GIDs per domain. It names a backend such as rid, ad, autorid or tdb and a range that must not overlap other ranges.

net ads keytab create

Writes the machine account's principals into /etc/krb5.keytab, so services on the member server can request Kerberos service tickets without storing a plaintext password.

wbinfo -t

Checks that the machine account trust secret still works against a domain controller; -u and -g list domain users and groups, and -i converts a SID to a UID.

samba-tool ntacl sysvolreset

Resets the NT ACLs on the SYSVOL share to the values defined by the provision, repairing permissions after a restore; samba-tool ntacl sysvolcheck reports mismatches without changing anything.

valid users

Share parameter listing accounts allowed to connect, given as plain usernames, @group or +group, DOMAIN\user, or variables such as %U; every other user is refused.

force user

Share parameter that performs every file operation as the named Unix account instead of the connecting user, which is common for shared project or scratch directories.

create mask

Share parameter that masks permissions of newly created files, default 0744; directory mask applies to new directories with default 0755, and the force mode parameters add bits on top.

[homes] share

Special share section that is expanded per user into that user's home directory, usually with path = /home/%U and browseable = no so only the owner sees the share.

vfs objects

Share or global parameter loading a stack of Samba VFS modules in order, for example acl_xattr for NT ACLs, recycle for a trash folder and full_audit for logging.

server smb encrypt

Global parameter with the values off, desired or required that controls SMB3 transport encryption; the per-share smb encrypt parameter overrides it for individual shares.

mount -t cifs

Mounts a remote SMB share using the kernel cifs driver; typical options are credentials=, uid=, gid=, vers= for the dialect and seal to force encryption.

vers=3.1.1

Mount and smbclient option that pins the SMB dialect; accepted values include 1.0, 2.0, 2.1, 3.0, 3.02 and 3.1.1, where 1.0 is only needed for very old servers.

cifs credentials file

Plain text file read by mount.cifs containing username=, password= and optional domain= lines; it must be readable only by root, typically mode 0600.

smbclient -L

Lists the shares and services a server exports without opening an interactive session; combine it with -N for anonymous access or -U to supply explicit credentials.

cifscreds

Stores user credentials in the kernel keyring so that a cifs mount done with the multiuser option uses each logged-in session's own identity instead of the mount owner's account.

getcifsacl

Displays the Windows NT ACL of a file inside a mounted cifs share in SDDL form; setcifsacl applies a modified ACL back to the server.

nsswitch.conf

Name service switch file; adding sss or winbind to the passwd, group and shadow lines lets Linux resolve domain accounts through SSSD or Winbind.

realm join

realmd command that joins the host to an AD or IPA domain; it discovers the realm, creates the machine account, writes /etc/krb5.keytab and configures SSSD.

sssd ad provider

SSSD domain setting id_provider = ad uses LDAP against the DC plus Kerberos for authentication; ldap_id_mapping = true derives UIDs from SIDs and avoids needing POSIX attributes.

sss_cache

SSSD utility that invalidates cached entries; -E expires everything, while -u and -g target one user or group and force a fresh lookup from the identity provider.

NFS sec=krb5

NFSv4 security flavor authenticating users with Kerberos; krb5i adds integrity checking and krb5p adds encryption, and clients need tickets obtained by rpc.gssd.

exportfs

Manages the kernel's NFS export table on the server; -ra re-reads /etc/exports and applies the changes, and -v shows what is currently exported.

setfacl

Sets POSIX ACL entries on files and directories; -m modifies, -x removes a named entry, -b clears all entries and -d defines default ACLs inherited by newly created objects.