Samba Basics
The Samba Basics domain checks whether you can explain and operate the core Samba daemons, configuration file, account database, and troubleshooting tools on a Linux host. The exam expects parameter-level familiarity with smb.conf, not just the ability to start a service.
Daemons and ports
- smbd handles SMB file and print services on TCP 445 and legacy TCP 139.
- nmbd provides NetBIOS name resolution and browsing on UDP 137/138; it is not required for pure SMB2/3 access by DNS name.
- winbindd maps Windows identities for NSS/PAM and is controlled separately from smbd.
- Modern packages use systemd units such as smb.service, nmb.service and winbind.service; reloading smbd does not necessarily reload every component.
Configuration model
smb.conf is INI-like: a [global] section plus one section per share. Parameter names and values are case-insensitive in practice, but consistency helps review. testparm -s prints the effective configuration; testparm also reports unknown parameters and basic errors. It does not prove that a share is reachable or that Unix permissions allow access.
Accounts and tools
Samba maintains its own passdb, commonly passdb backend = tdbsam. Create a Unix account first, then set the SMB password with smbpasswd -a; pdbedit -L lists Samba users. smbclient -L //server -U user lists shares, and smbstatus shows current sessions and locked files.
Worked example
A host must share /srv/docs with user alice. Create the Unix user and directory, run smbpasswd -a alice, then add a share with path = /srv/docs, read only = yes, and valid users = alice. Run testparm, reload smbd, and test with smbclient //localhost/docs -U alice. Reasoning: the Unix account supplies the UID; the Samba password authenticates SMB; valid users restricts the share; read only enforces write denial at the share layer even if Unix mode bits would allow writes.
Traps
Assuming testparm validates share access; forgetting the Unix account before smbpasswd; expecting nmbd to be required for every SMB2/3 mount; leaving SMB1 enabled for old clients; and editing smb.conf without reloading the service.