Samba Client Configuration
The Samba Client Configuration domain tests command-line access to SMB shares and persistent CIFS mounts from Linux. The exam expects you to choose the right tool, select an SMB dialect, protect credentials, and understand client-side UID/GID mapping.
smbclient and mounts
smbclient -L //server -U user lists shares and smbclient //server/share -U user opens an interactive session. Options include -k for Kerberos, -m SMB3 to select a protocol, and -c for commands such as ls, get and put. smbclient transfers files but does not mount a file system. Mounting uses mount.cifs from cifs-utils, for example mount.cifs //server/share /mnt -o credentials=/root/.smbcred,vers=3.1.1,uid=1000,gid=1000,file_mode=0660,dir_mode=0770.
Credentials and security
A credentials file contains username=, password= and optionally domain=; it should be mode 600. sec=krb5 uses a Kerberos ticket and requires a valid cache and service principal, while sec=ntlmssp uses NTLM authentication. The multiuser option allows different users to access one mount with per-user credentials stored by cifscreds add; it is not the same as mounting separately for each user. nounix disables Unix extensions when the server behaves inconsistently.
Persistent mounts
/etc/fstab entries can include _netdev, noauto, and x-systemd.automount so boot does not block on an unavailable server. Numeric uid= and gid= are client-side mappings; they do not change ownership on the server and do not override server ACLs.
Worked example
A team needs a share mounted at /mnt/team with SMB 3.1.1. Create /root/.teamcred with username, password and domain, run chmod 600 /root/.teamcred, then mount with credentials=/root/.teamcred,vers=3.1.1,uid=2000,gid=2000,file_mode=0660,dir_mode=0770. Reasoning: the credentials file avoids a password in fstab, vers selects a modern dialect, and numeric uid/gid make the mount usable by the local account. If the server requires Kerberos, replace the credentials approach with sec=krb5 and a valid ticket.
Traps
World-readable credential files; using vers=1.0 when SMB1 is disabled; assuming uid= accepts a username rather than a number; and expecting sec=krb5 to work without a ticket.