LPIC-3 Mixed Environment study plan

Provision a Samba AD DC in a lab VM with samba-tool domain provision using --dns-backend=SAMBA_INTERNAL, a dedicated realm, and a strong Administrator password.

Verify the provisioned forest and domain function levels with samba-tool domain level show and record them; confirm the DC's A and SRV records with dig against the internal DNS.

Create two OUs, three users, and two groups with samba-tool ou/user/group create, then set a user attribute such as telephoneNumber with samba-tool user edit or ldbmodify.

Configure /etc/krb5.conf from the generated file, obtain a TGT with kinit Administrator, and inspect the ticket with klist.

Point the member server's /etc/resolv.conf only at the DC and verify the _kerberos._tcp and _ldap._tcp SRV records with dig.

Join the member server to the domain with net ads join -U Administrator and confirm the machine account with net ads testjoin and smbclient -L.

Configure nsswitch.conf and a winbind rid idmap range in smb.conf, start winbind, and resolve domain users and groups with wbinfo -u, wbinfo -g, and getent passwd.

Add an A record and a CNAME with samba-tool dns add, query both with samba-tool dns query, and correct any stale resolver entries.

Map the roles of smbd, nmbd, and winbindd to their ports and log files, and confirm listeners with ss -tlnp plus active sessions with smbstatus.

Write a minimal smb.conf global section with server role, realm, idmap ad backend, and log level 2 auth:5, then validate it with testparm -s.

Configure an idmap ad backend with schema_mode = rfc2307 and a dedicated range; verify the mapping with wbinfo --name-to-sid and id.

Troubleshoot one deliberately broken AD join or idmap mapping using log.winbind at level 10, and capture the exact failing log line plus the fix.

Create a [homes] share and a group share with valid users, read only = no, create mask = 0660, directory mask = 2770, and inherit permissions = yes; confirm parsed values with testparm -s.

Apply POSIX ACLs with setfacl, including a default ACL, and compare getfacl output with the effective Samba access for a domain user and a local user.

Test each share from a separate client with smbclient using two accounts and record allow/deny for read, write, and delete in a matrix.

Use smbstatus to list connections and open files during an active smbclient session, and reload changed configuration with smbcontrol smbd reload-config.

Configure [homes], a department share with force group, and a drop-box share with write list and read only = yes; verify every parameter with testparm -s.

Implement access restriction with valid users, invalid users, read list, write list, and admin users, then prove each rule with smbclient put/get/rm attempts.

Configure SMB3 transport encryption with smb encrypt = required on one share and confirm that smbclient fails without -e and succeeds with -e.

Mount the department share with mount.cifs using a 0600 credentials file and vers=3.1.1, then verify with findmnt and a write test as a non-root user.

Configure a multiuser CIFS mount (multiuser, sec=krb5) and prove per-user access by running su - -c 'touch /mnt/share/file'.

Install and configure SSSD for the AD domain with id_provider=ad and Kerberos authentication, then verify getent passwd, id, and SSH login for a domain user.

Enable pam_mkhomedir and confirm that first login creates a home directory with the correct owner and mode.

Compare winbind and SSSD for AD integration in a four-row table covering id mapping, offline cache, PAM integration, and schema requirements.

Configure an SSSD domain against FreeIPA or an LDAP+Kerberos pair with id_provider=ipa or ldap, and verify kinit, getent, and id for a remote user.

Export an NFSv4 directory with sec=krb5, mount it on a client using a Kerberos ticket, and verify that UID/GID mapping matches the directory owner.

Configure a Samba share for Kerberos authentication (security = ads and a dedicated keytab) and list it with smbclient -k.

Trace one request end to end (kinit → SSSD → NSS/PAM → NFS or Samba) and document the identity flow in a short table.

Rebuild a compact lab from scratch in 90 minutes: AD DC, joined member server, idmap, three shares with distinct ACLs, and two client mounts.

Complete a timed 60-question practice set spanning all five domains and tag every wrong answer with its domain number.

Re-run targeted labs for the three weakest tagged areas and record before/after command output.

Write a one-page cheat sheet of 20 smb.conf parameters and 10 commands from memory, then correct it against the documentation.