Network Client Management →mediumMultiple ChoiceObjective-mapped

LPIC-2 Network Client Management Practice Question

A Samba share is configured with 'valid users = @staff' but users in the staff group still get 'NT_STATUS_ACCESS_DENIED' when accessing the share. The server uses 'security = user'. Which additional configuration is required?

⚠ Common exam trap

Candidates often assume group membership alone grants access, overlooking that Samba's user-level security requires a separate password database entry for each authenticated user.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Run smbpasswd -a for each user

With 'security = user', Samba requires each user to have a separate Samba password stored in the smbpasswd file (or another passdb backend). Even if a user is a member of the 'staff' group and exists in the system's /etc/passwd, they cannot authenticate to the share without an smbpasswd entry. Running 'smbpasswd -a' for each user creates that entry, resolving the NT_STATUS_ACCESS_DENIED error.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Set 'guest ok = yes'
Why it's wrong here
Guest access bypasses authentication, but the issue is authentication.
✗
Set 'force group = staff'
Why it's wrong here
Group membership is already correct.
✓
Run smbpasswd -a for each user
Why this is correct
Samba passwords are separate from system passwords.
✗
Add the share to [global]
Why it's wrong here
Shares are defined individually.

Visual reference

Go deeper

LPIC-2 Network Client Management Practice Question

Why each option matters

Option-by-option breakdown

Related to this question