Q-1: - Which SELinux security context used for SAMBA ?
Ans: - samba_share_t
Ans: - samba_share_t
Q-2: - On which ports SAMBA server works ?
Ans: - UDP port 137 for netbios-ns, the NETBIOS Name Service
- UDP port 138 for netbios-dgm, the NETBIOS Datagram Service
- TCP port 139 for netbios-ssn, the NETBIOS session service
- TCP port 445 for microsoft-ds, the Microsoft Domain Service
Ans: - UDP port 137 for netbios-ns, the NETBIOS Name Service
- UDP port 138 for netbios-dgm, the NETBIOS Datagram Service
- TCP port 139 for netbios-ssn, the NETBIOS session service
- TCP port 445 for microsoft-ds, the Microsoft Domain Service
Q-3: - What are the Secrity or Authentication Mode for SAMBA server?
Ans: - ADS
DOMAIN
SERVER
USER
SHARE
Ans: - ADS
DOMAIN
SERVER
USER
SHARE
Q-4: - How to Manually Create Machine Trust Accounts ?Ans: - /usr/sbin/useradd -g machines -d /var/lib/nobody -c "machine nickname" -s /bin/false machine_name$
passwd -l machine_name$
passwd -l machine_name$
Q-5: - What are the SAMBA server Types ?
Ans: - - Primary Domain Controller (PDC)
- Backup Domain Controller (BDC)
- ADS Domain Controller
Ans: - - Primary Domain Controller (PDC)
- Backup Domain Controller (BDC)
- ADS Domain Controller
Q-6: - Which protocol SAMBA server uses ?
Ans: - SMB, which stands for Server Message Block, is a protocol for sharing files, printers, serial ports, and communications abstractions such as named pipes and mail slots between computers.
Ans: - SMB, which stands for Server Message Block, is a protocol for sharing files, printers, serial ports, and communications abstractions such as named pipes and mail slots between computers.
Q-7: - How Does a Workstation find its Domain Controller?
Ans: - There are two different mechanisms to locate a domain controller: one
method is used when NetBIOS over TCP/IP is enabled and the other when
it has been disabled in the TCP/IP network configuration. Where NetBIOS over TCP/IP is disabled, all name resolution involves the use of DNS, broadcast messaging over UDP, as well as Active Directory communication technologies.
Ans: - There are two different mechanisms to locate a domain controller: one
method is used when NetBIOS over TCP/IP is enabled and the other when
it has been disabled in the TCP/IP network configuration. Where NetBIOS over TCP/IP is disabled, all name resolution involves the use of DNS, broadcast messaging over UDP, as well as Active Directory communication technologies.
Q-8: - Can Samba Be a Backup Domain Controller to an NT4 PDC?
Ans: - No. The native NT4 SAM replication protocols have not yet been fully implemented.
Ans: - No. The native NT4 SAM replication protocols have not yet been fully implemented.
Q-9: - How Do I Replicate the smbpasswd File?
Ans: - Replication of the smbpasswd file is sensitive. It has to be done whenever
changes to the SAM are made. Every user's password change is done in
the smbpasswd file and has to be replicated to the BDC. So replicating the
smbpasswd file very often is necessary.As the smbpasswd file contains plaintext password equivalents, it must not be sent unencrypted over the wire. The best way to set up smbpasswd replication from the PDC to the BDC is to use the utility rsync. rsync can use ssh as a transport. ssh itself can be set up to accept only rsync transfer without requiring the user to type a password.As said a few times before, use of this method is broken and awed. Machine trust accounts will go out of sync, resulting in a broken domain. This method is not recommended. Try using LDAP instead.
Ans: - Replication of the smbpasswd file is sensitive. It has to be done whenever
changes to the SAM are made. Every user's password change is done in
the smbpasswd file and has to be replicated to the BDC. So replicating the
smbpasswd file very often is necessary.As the smbpasswd file contains plaintext password equivalents, it must not be sent unencrypted over the wire. The best way to set up smbpasswd replication from the PDC to the BDC is to use the utility rsync. rsync can use ssh as a transport. ssh itself can be set up to accept only rsync transfer without requiring the user to type a password.As said a few times before, use of this method is broken and awed. Machine trust accounts will go out of sync, resulting in a broken domain. This method is not recommended. Try using LDAP instead.
Q-10: - Can Samba fully replace my Windows NT server that is not a Primary Domain Controller (PDC)?
Ans: - Samba can completely serve files and printers to Windows, just as a Windows NT server would.
Ans: - Samba can completely serve files and printers to Windows, just as a Windows NT server would.
Q-11: - Can Samba replaces my Windows NT PDC?
Ans: - Not completely. Samba domain control capabilities for a Windows 9x client are
solid and complete, and so these clients would probably never know the difference. The domain control support for Windows NT/2000 clients is still being developed. Currently, enough has been implemented to allow a Windows NT client to join a Samba-controlled domain, but there is more to domain control than that. The most conspicuous absence is the lack of support for Windows NT trust relationships and the SAM replication protocol used between NT PDCs and Backup Domain Controllers (BDCs).
Ans: - Not completely. Samba domain control capabilities for a Windows 9x client are
solid and complete, and so these clients would probably never know the difference. The domain control support for Windows NT/2000 clients is still being developed. Currently, enough has been implemented to allow a Windows NT client to join a Samba-controlled domain, but there is more to domain control than that. The most conspicuous absence is the lack of support for Windows NT trust relationships and the SAM replication protocol used between NT PDCs and Backup Domain Controllers (BDCs).
Q-12: - What TCP and UDP ports required for NetBIOS over TCP/IP use?
Ans: - The NBT name service uses port 137/udp, the NBT session service uses port139/tcp, and the NBT datagram service uses port 138/udp.
Ans: - The NBT name service uses port 137/udp, the NBT session service uses port139/tcp, and the NBT datagram service uses port 138/udp.
Q-13: - How SMB protocol works?
Ans: - There will be three stages in creating an SMB connection between a client and a specific share on a server.
Ans: - There will be three stages in creating an SMB connection between a client and a specific share on a server.
The
first stage in connecting to an SMB share is to negotiate the SMB
protocol dialect to use. In the request packet, the client sends a text
listing of all the SMB dialects that it understands. The server selects
the most advanced protocol that it knows and responds to the client,
specifying the protocol number from the list. At this point, the client
and server have agreed that SMB commands can be used for the remainder
of the conversation.
The
second stage is to create a session connection between the client and
server. To do this, the client issues a session setup request, which
includes a sername and some proof of validity, such as a password. The
server attempts to validate requesting user. If successful, the server
then returns a session UID to client. This UID is unique for each
session and has no relation to the server internal representation of
users.
The
third stage before access to files on a remote share is allowed is for
the client to make a successful tree connection to the shared resource.
The client sends to the server a tree connect request, which includes
the UID previously issued by the server. At this stage the server
verifies that the authenticated user is authorized to access the
requested resource. If the user has sufficient privileges to access the
share, the client is issued a tree connection ID (TID). The TID is used
in all requests to access files contained in the resource to which the
TID refers.
In this way SMB protocol works.
In this way SMB protocol works.
Q-14: - How man sections samba configuration file (smb.conf) contains?
Ans: - smb.conf file contains three sections.
1. [global] Contains settings that determine Samba overall behavior.
2. [homes] A default share for providing a home directory for all users.
3. [printers] A default share for exporting all printers on the host via CIFS.
Ans: - smb.conf file contains three sections.
1. [global] Contains settings that determine Samba overall behavior.
2. [homes] A default share for providing a home directory for all users.
3. [printers] A default share for exporting all printers on the host via CIFS.
Q-15: - If a netbios name is not defined in smb.conf, than what will be netbios name?
Ans: - If a netbios name is not defined, Samba will use the IP hostname of the server by default.
Ans: - If a netbios name is not defined, Samba will use the IP hostname of the server by default.
Q-16: - I want to use User level security for my samba server than what i have to add in smb.conf file?
Ans: - security = user
Ans: - security = user
Q-17: - How you will verify that your smb.conf file doesn’t have any mistakes and misspellings?
Ans: - "testparm " tool that verifies the syntax of a configuration file(smb.conf). testparm -s smb.conf
Ans: - "testparm " tool that verifies the syntax of a configuration file(smb.conf). testparm -s smb.conf
Q-18: - What is the use of "smbclient" command?
Ans: - "smbclient" is used to display the list of shares on your server. This verifies that smbd is running and functioning correctly. The -L option instructs smbclient to enumerate the shares on the server rather than actually connecting to one. The -N switch instructs smbclient to use an anonymous login rather than the login name of the current user.
Ans: - "smbclient" is used to display the list of shares on your server. This verifies that smbd is running and functioning correctly. The -L option instructs smbclient to enumerate the shares on the server rather than actually connecting to one. The -N switch instructs smbclient to use an anonymous login rather than the login name of the current user.
smbclient -L localhost -N
Antother use of "smbclient" command to connect the samba share.
smbclient //<server>/<share> -U <username>
Q-19: - Explain "smbstatus" command?
Ans: - The smbstatus utility displays information about connected users and currently locked files.
Ans: - The smbstatus utility displays information about connected users and currently locked files.
Q-20: - Is it possible for Samba to share file systems that have been mounted using NFS?
Ans: - Yes. However, this can be problematic if the NFS server that provides the file system fails, causing the Samba server to hang. It is always safer to use Samba to share a local file system.
Ans: - Yes. However, this can be problematic if the NFS server that provides the file system fails, causing the Samba server to hang. It is always safer to use Samba to share a local file system.
Q-21: - How many simultaneous connections can a Samba server support?
Ans: - In theory, there is no limit. In practice, the limit is determined by the server’s hardware, specifically the total amount of available RAM and the CPU power. It might also depend on the amount of activity from the smbd processes.
Ans: - In theory, there is no limit. In practice, the limit is determined by the server’s hardware, specifically the total amount of available RAM and the CPU power. It might also depend on the amount of activity from the smbd processes.
Q-22: - Can Samba be a member of more than one workgroup at the same time?
Ans: - No, Samba can be a member of only one workgroup.
Ans: - No, Samba can be a member of only one workgroup.
Q-23: - What is SWAT?
Ans: - SWAT is GUI Based administration tool for samba server.
Ans: - SWAT is GUI Based administration tool for samba server.
Q-24: - I am trying to use SWAT, but I keep getting the message There was no
response. The server could be down or not responding. What is the
problem?
Ans: - The most likely cause is that SWAT is not listening to connections, or you have used the wrong URL in trying to connect to SWAT. SWAT usually lives behind port 901, so the URL you should use is http://ID_ADDRESS_OF_SERVER:901/
Ans: - The most likely cause is that SWAT is not listening to connections, or you have used the wrong URL in trying to connect to SWAT. SWAT usually lives behind port 901, so the URL you should use is http://ID_ADDRESS_OF_SERVER:901/
Q-25: - Can i set empty password for samba user?
Ans: - yes, If you want to set the value to an empty password, you must change
Ans: - yes, If you want to set the value to an empty password, you must change
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
to
NOPASSWORDXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
in your smbpasswd file.
in your smbpasswd file.
Note:
- if you have edited the smbpasswd file by hand, make sure that the LAN
Manager and NT password fields contain exactly 32 characters, no more
and no fewer. If these fields do not have exactly 32 characters, Samba
will not be able to correctly read the entry.
or You can modify by "smbpasswd" command.
smbpasswd -n USER_NAME
Also you have to set the null passwords parameter to yes in the [global] section of smb.conf:
null passwords = yes
Q-26: - Does Samba support PAM?
Ans: - Yes
Ans: - Yes
Q-27: - What is role of "NTLM"?
Ans: - The challenge/response authentication protocol available to Windows clients and servers for validating connection requests.
Ans: - The challenge/response authentication protocol available to Windows clients and servers for validating connection requests.
Q-28: - Explain "force group" parameter used in smb.conf?
Ans: - It will define the group id to be used for all file access in the place of the user’s primary group.
Ans: - It will define the group id to be used for all file access in the place of the user’s primary group.
Q-29: - Explain "force user" parameter used in smb.conf?
Ans: - It will define the user id to be used for all file access.
Ans: - It will define the user id to be used for all file access.
Q-30: - Explain "write list" parameter used in smb.conf?
Ans: - A list of users and/or groups that should be given write access even if the read only parameter has been enabled.
Ans: - A list of users and/or groups that should be given write access even if the read only parameter has been enabled.
Q-31: - My clients are getting the error message that the Disk is Full when
trying to print to my Samba server, but there is plenty of space. What
is the problem?
Ans: - If smbd is unable to write the spooled file to the directory defined by the path parameter for a printer if the write permission were denied, for example it would respond to the client with the message, Disk is Full. Samba will also return this error message if the amount of free disk space in the spool directory has fallen below the value specified by the min print space parameter.
Ans: - If smbd is unable to write the spooled file to the directory defined by the path parameter for a printer if the write permission were denied, for example it would respond to the client with the message, Disk is Full. Samba will also return this error message if the amount of free disk space in the spool directory has fallen below the value specified by the min print space parameter.
Q-32: - When I click on my Samba server in the network neighborhood, I am
continually prompted for a password to the IPC$ share no matter what I
enter.
Ans: - The Windows client is attempting to use encrypted passwords. However, the Samba server is configured to support only clear-text passwords. You should either enable encrypted passwords on the server or enable clear-text passwords on the Windows client.
Ans: - The Windows client is attempting to use encrypted passwords. However, the Samba server is configured to support only clear-text passwords. You should either enable encrypted passwords on the server or enable clear-text passwords on the Windows client.
Q-33: - Why is security = domain better than security = server?
Ans: - There are three reasons why security = domain is better. The first is because this method enables the Samba server to participate in domain trust relationships. This is impossible with server-level security. The second reason is that, under server-level security, each smbd process must keep an open connection with the authentication server. This can drain a Windows NT PDC quickly. Under domain-level security, this connection is maintained only long enough to perform the validation, thus conserving valuable resources. The final reason is that, as a domain member, the Samba server has access to much more information about user accounts, which can be used to automate the creation and deletion of user accounts upon demand.
Ans: - There are three reasons why security = domain is better. The first is because this method enables the Samba server to participate in domain trust relationships. This is impossible with server-level security. The second reason is that, under server-level security, each smbd process must keep an open connection with the authentication server. This can drain a Windows NT PDC quickly. Under domain-level security, this connection is maintained only long enough to perform the validation, thus conserving valuable resources. The final reason is that, as a domain member, the Samba server has access to much more information about user accounts, which can be used to automate the creation and deletion of user accounts upon demand.
Q-34: - what is nmbd daemon?
Ans: - This daemon handles all name registration and resolution requests. It is the primary vehicle involved in network browsing. It handles all UDP-based protocols. The nmbd daemon should be the first command started as part of the Samba startup process.
Ans: - This daemon handles all name registration and resolution requests. It is the primary vehicle involved in network browsing. It handles all UDP-based protocols. The nmbd daemon should be the first command started as part of the Samba startup process.
Q-35: - What is smdb daemon?
Ans: - This daemon handles all TCP/IP-based connection services for file- and print-based operations. It also manages local authentication. It should be started immediately following the startup of nmbd.
Ans: - This daemon handles all TCP/IP-based connection services for file- and print-based operations. It also manages local authentication. It should be started immediately following the startup of nmbd.
Q-36: - What is winbindd daemon?
Ans: - This daemon should be started when Samba is a member of a Windows NT4 or ADS domain. It is also needed when Samba has trust relationships with another domain. The winbindd daemon will check the smb.conf file for the presence of the idmap uid and idmap gid parameters. If they are found, winbindd will use the values specified for UID and GID allocation. If these parameters are not specified, winbindd will start but it will not be able to allocate UIDs or GIDs.
Ans: - This daemon should be started when Samba is a member of a Windows NT4 or ADS domain. It is also needed when Samba has trust relationships with another domain. The winbindd daemon will check the smb.conf file for the presence of the idmap uid and idmap gid parameters. If they are found, winbindd will use the values specified for UID and GID allocation. If these parameters are not specified, winbindd will start but it will not be able to allocate UIDs or GIDs.
Q-37: - Explain the parameter "wins support = Yes" used in smb.conf?
Ans: - If the Samba server was configured to provide WINS support ("wins support = Yes"), then the WINS server is able to provide name resolution for all of the hosts that are not listed in the /etc/hosts file or within the DNS. Making this adjustment in the Name Service Switch configuration file (/etc/nsswitch.conf) allows the Linux system to query the WINS server for local name resolution. This saves manual adjustments to host files.
Ans: - If the Samba server was configured to provide WINS support ("wins support = Yes"), then the WINS server is able to provide name resolution for all of the hosts that are not listed in the /etc/hosts file or within the DNS. Making this adjustment in the Name Service Switch configuration file (/etc/nsswitch.conf) allows the Linux system to query the WINS server for local name resolution. This saves manual adjustments to host files.
Q-38: - How to automate SMB share mounting during system startup?
Ans: - Add smb share entry in /etc/fstab file.
Ans: - Add smb share entry in /etc/fstab file.
//IP_ADDRESS_OF_SERVER/Shared /shared smbfs noauto,defaults 0 0
Q-39: - how to start and stop samba server?
Ans: - /etc/init.d/smb restart
Ans: - /etc/init.d/smb restart
For any query please feel free to contact me my email id is sashwatkatore@gmail.com.
