LPIC-2 File Sharing and Samba — 10 Questions

Question 1

Which TWO commands can be used to query a Samba server for its available shares and workgroups?

Accepted Answer

smbclient -L. Only `smbclient -L` correctly lists both available shares and workgroups from a Samba server. `nmblookup` is used for NetBIOS name resolution and can query workgroup names but does not list shared resources. The other options either inspect local state or are not applicable.

Answer

net share

Answer

smbstatus

Answer

testparm

Answer

nmblookup

Question 2

A company recently upgraded their Samba server from version 4.8 to 4.13. Users report that they can connect to shares but cannot write files. The Samba team verified that the share configuration has 'writable = yes' and the Linux filesystem permissions are correct (777). Which global parameter is most likely causing the issue?

Accepted Answer

server min protocol = SMB2_02. Samba 4.13 defaults to requiring SMB3_11 as the minimum protocol, which provides features like persistent handles and leases. If the administrator sets 'server min protocol = SMB2_02', the server allows SMB2 connections, but SMB2 does not support these features. Consequently, clients can connect but may fail to write files if the share configuration relies on persistent handles or if the client expects SMB3 features. The upgrade from 4.8 to 4.13 changed the default minimum protocol from SMB2_02 to SMB3_11, and explicitly overriding it to SMB2_02 can lead to write failures.

Answer

security = user

Answer

map to guest = Bad User

Answer

workgroup = EXAMPLE

Question 3

An administrator needs to configure Samba to use encrypted passwords via LDAP backend. The LDAP server is already set up with the necessary schema. Which passdb backend should be specified in smb.conf?

Accepted Answer

passdb backend = ldapsam:ldap://ldap.example.com. The `ldapsam` passdb backend is the Samba module specifically designed to store and authenticate user accounts (including encrypted passwords) against an LDAP directory. The syntax `ldapsam:ldap://ldap.example.com` tells Samba to use the LDAP SAM (Security Account Manager) backend, which maps Samba's account attributes to LDAP entries using the standard Samba LDAP schema (e.g., sambaSamAccount).

Answer

passdb backend = ldap:ldap://ldap.example.com

Answer

passdb backend = secret:ldap://ldap.example.com

Answer

passdb backend = sam:ldap://ldap.example.com

Question 4

A company wants to use Samba to share files with Windows clients. Which service must be enabled in Samba to support Windows Active Directory domain membership?

Accepted Answer

winbind. Winbind (winbindd) is the Samba service that integrates with Windows Active Directory by resolving user and group information from the domain controller. It uses the Microsoft Active Directory authentication protocol (Kerberos) and LDAP to map Windows domain users to local Unix accounts, enabling domain membership and single sign-on.

Answer

nmbd

Answer

smbd

Answer

swat

Question 5

A Samba administrator notices that Windows clients cannot access a shared directory. The share is defined in smb.conf as follows:

[shared]
path = /srv/samba/shared
valid users = @staff
browseable = yes
read only = no

The /srv/samba/shared directory has permissions 755 and is owned by root:staff. Which is the most likely cause of the access issue?

Accepted Answer

The 'staff' group lacks write permission on the directory. The 'staff' group lacks write permission on the directory because the directory has permissions 755, which grants write access only to the owner (root). Even though the share is defined as 'read only = no', Samba enforces filesystem-level permissions. Since the 'valid users = @staff' restricts access to members of the staff group, they need write permission on the directory to create or modify files. The group 'staff' has only read and execute permissions (r-x), so write operations fail.

Answer

The 'valid users' parameter is misspelled

Answer

The share is defined as browseable but not listed

Answer

SELinux is blocking access and must be disabled

Question 6

A Samba server is configured as a domain member in an Active Directory environment. Users report that after changing their password on a Windows client, they cannot authenticate to Samba shares. The Samba server is using winbind and the 'idmap_ad' backend. What is the most likely cause?

Accepted Answer

Password changes are not replicated to the domain controller that Samba authenticates against. In an Active Directory domain member configuration, Samba authenticates against a specific domain controller (DC). When a user changes their password on a Windows client, the new password is initially written to the DC that processed the change. If the Samba server's winbind service is authenticating against a different DC that has not yet received the replicated password update, authentication will fail. This is the most likely cause because password replication in AD is not instantaneous and depends on replication latency.

Answer

The 'winbind offline logon' option is not enabled

Answer

The winbind cache is outdated and needs to be cleared

Answer

The 'idmap backend' must be set to 'rid' instead of 'ad'

Question 7

A Samba share is configured with 'force user = jane'. A user 'bob' accesses the share. With what effective user ID will file operations be performed?

Accepted Answer

jane. The 'force user' directive in Samba overrides the authenticated user's identity for all file operations on the share. When 'force user = jane' is set, any user accessing the share, including 'bob', will have their effective user ID changed to 'jane' for all file reads, writes, and ownership checks. This ensures that files created or modified on the share are owned by 'jane', regardless of who actually connects.

Answer

root

Answer

nobody

Answer

bob

Question 8

Which Samba component provides NetBIOS name resolution and browsing services?

Accepted Answer

nmbd. The nmbd daemon is the Samba component responsible for NetBIOS name resolution and browsing services. It listens for NetBIOS name service requests (port 137/UDP) and datagram distribution (port 138/UDP), enabling Windows clients to resolve NetBIOS names to IP addresses and participate in network browsing (e.g., listing shares in Network Neighborhood). Without nmbd, Samba cannot provide legacy NetBIOS-based name resolution or browse lists, though modern Samba can also use DNS-based discovery.

Answer

swat

Answer

smbd

Answer

winbind

Question 9

A Samba server is configured with 'security = ads' and joined to an Active Directory domain. Users can authenticate but cannot access shares. The smb.conf includes 'winbind use default domain = yes'. What could be the problem?

Accepted Answer

The 'valid users' parameter uses domain prefix while default domain is set. When 'winbind use default domain = yes' is set, Winbind strips the domain prefix from usernames, so users authenticate as 'username' instead of 'DOMAIN\username'. If the 'valid users' parameter in a share definition explicitly uses the domain prefix (e.g., 'valid users = DOMAIN\username'), the stripped username will not match, and access is denied. This mismatch is the most direct cause of authentication succeeding but share access failing.

Answer

The 'winbind use default domain' option should be 'no'

Answer

The 'idmap backend' is not configured

Answer

The Samba server's time is not synchronized with the domain controller

Question 10

An administrator needs to configure Samba to allow guest access to a share. Which two parameters must be set?

Accepted Answer

guest ok = yes in the share definition. Setting `guest ok = yes` in the share definition explicitly allows guest (anonymous) access to that specific Samba share. Without this parameter, the share will require authentication even if other guest-related settings are configured globally.

Answer

security = share

Answer

guest account = nobody