5.1Configuring and Managing Samba

Mixed environments constantly need "use a Linux server's files as an ordinary network drive from Windows." Samba implements the SMB/CIFS protocol, turning Linux into a share server (sometimes an AD domain member) as seen from Windows. It carries the heaviest weight (importance 4) in this subtopic on exam 202.

5.1.1Configuration file and daemons

• The heart of configuration is /etc/samba/smb.conf. The [global] section sets server-wide behavior (workgroup/domain, security mode, etc.); each [sharename] section defines a share's path and permissions. Logs live under /var/log/samba/ by default.
• smbd is the core file/printer sharing daemon—it handles SMB/CIFS connections, authentication, and access control. nmbd handles NetBIOS name resolution and browsing (NetBIOS over TCP/IP, master browser duties). winbindd pulls Windows domain/AD user and group information into Linux, mapping them to Unix accounts and enabling AD-integrated authentication.

5.1.2Validation, operations, and client commands

• testparm validates smb.conf syntax—the standard step before restarting daemons; it reports errors/warnings and the effective configuration. smbpasswd manages Samba's own user database (passwords), set separately from Unix account passwords (smbpasswd -a user adds an entry).
• smbstatus shows current connections and lock status (who is connected to which share). smbcontrol sends control signals to running smbd/nmbd/winbindd (e.g., to reload configuration). nmblookup tests NetBIOS name resolution (checking name-to-IP lookups).
• smbclient is an FTP-like interactive client for connecting to shares (smbclient //server/share -U user to verify access and transfer files). net is Samba's general-purpose administration command (a multi-purpose set of subcommands for domain join, share listing, user management, etc.). samba-tool manages Samba acting as an AD DC (domain controller)—domains, users, groups, GPOs, and more.

A typical operational flow clarifies the structure. First, in /etc/samba/smb.conf's [global] section you set the workgroup name and security mode; in a share section like [data] you define the path (path = /srv/samba/data), writability (writable = yes), and valid users (valid users = @staff). After editing, always validate syntax with testparm before restarting smbd/nmbd. Samba-side authentication uses an smbpasswd database independent of Unix passwords; a new user cannot connect until you set a Samba password with smbpasswd -a. When "who is locking which file" becomes a mystery during operations, smbstatus is the first move—it lists active sessions, shares, and locks. Verify connectivity from a client with smbclient: smbclient -L //server lists shares, and smbclient //server/share opens an interactive session. When joining an AD environment, winbindd performs user mapping of Windows SIDs to Unix UID/GID, aligning them with Linux file permissions. Unix permissions alone are often too coarse for shared directories, so ACLs (checked with getfacl, set with setfacl) are commonly layered on top to express things like "only this group may write." samba-tool is used when Samba itself runs as an AD domain controller (creating domains, managing users/groups/GPOs), while ordinary file-server administration relies on net and the commands above.

5.1.3Section summary

• Configuration lives in /etc/samba/smb.conf ([global] + [sharename]). Always validate with testparm before restarting. Daemons: smbd = sharing, nmbd = name resolution, winbindd = pulling in AD info
• User management via smbpasswd, monitoring via smbstatus/smbcontrol, client verification via smbclient, AD DC administration via samba-tool. Layer ACLs (getfacl/setfacl) for fine-grained permissions