SAMBA

Samba essentially consists of two or three daemons. A daemon is a UNIX application that runs in the background and provides services. An example of a service is the Apache Web server for which the daemon is called httpd. In the case of Samba there are three daemons, two of which are needed as a minimum.

The Samba server is made up of the following daemons:

nmbd

This daemon handles all name registration and resolution requests. It is the primary vehicle involved in network browsing. It handles all UDP-based protocols. The nmbd daemon should be the first command started as part of the Samba startup process.

smbd

This daemon handles all TCP/IP-based connection services for file- and print-based operations. It also manages local authentication. It should be started immediately following the startup of nmbd.

winbindd

This daemon should be started when Samba is a member of a Windows NT4 or ADS domain. It is also needed when Samba has trust relationships with another domain. The winbindd daemon will check the smb.conf file for the presence of the idmap uid and idmap gidparameters. If they are are found, winbindd will use the values specified for for UID and GID allocation. If these parameters are not specified, winbindd will start but it will not be able to allocate UIDs or GIDs.

When Samba has been packaged by an operating system vendor, the startup process is typically a custom feature of its integration into the platform as a whole. Please refer to your operating system platform administration manuals for specific information pertaining to correct management of Samba startup.

Example Configuration:-

There are sample configuration files in the examples subdirectory in the source code distribution tarball package. It is suggested you read them carefully so you can see how the options go together in practice. See the man page for all the options. It might be worthwhile to start out with thesmb.conf.default configuration file and adapt it to your needs. It contains plenty of comments.

/usr/sbin/smbd >>> Main SMB service daemon.

/usr/sbin/nmbd >>> Netbios name service daemon (Act as WINS server).

/etc/samba/samba.conf >>> Samba's Primary configuration file.

/usr/bin/smbclient >>> connects to SMB shares, FTP like syntax

/sbin/mount.cifs >>> Mounts SMB shares on a designed directory.

/sbin/umount.cifs >>> Umounts a SMB shared directory.

/usr/bin/testparm >>> tests validity of /etc/samba/smb.conf

/etc/init.d/smb >>> daemon start & stop control script.

cifs >>> file system extension to mount smb shares on directories; Use with the mount -t command.

/usr/bin/smbprint >>> A script to print to a printer on a SMB print.

/usr/bin/smbstatus >>> List current SMB connections for the local host.

Directory                                       Description


/usr/local/samba                             Main tree
/usr/local/samba/bin                     Binaries
/usr/local/samba/lib                      smb.conf, lmhosts, configuration files, etc.
/usr/local/samba/man                   Samba documentation
/usr/local/samba/private             Samba-encrypted password file
/usr/local/samba/swat                   SWAT files
/usr/local/samba/var                      Samba log files, lock files, browse list info, shared memory    files, process ID files

Ports: Samba uses UDP ports 137 through 139 and TCP ports 137, 139 and 445.

Test Your Config File with testparm

It's important to validate the contents of the smb.conf file using the testparm program. If testparm runs correctly, it will list the loaded services. If not, it will give an error message. Make sure it runs correctly and that the services look reasonable before proceeding. Enter the command:

 root#  testparm /etc/samba/smb.conf
 

Testparm will parse your configuration file and report any unknown parameters or incorrect syntax. It also performs a check for common misconfigurations and will issue a warning if one is found.
Always run testparm again whenever the smb.conf file is changed!
The smb.conf file is constantly checked by the Samba daemons smbd and every instance of itself that it spawns, nmbd and winbindd. It is good practice to keep this file as small as possible. Many administrators prefer to document Samba configuration settings and thus the need to keep this file small goes against good documentation wisdom. One solution that may be adopted is to do all documentation and configuration in a file that has another name, such as smb.conf.master. The testparm utility can be used to generate a fully optimized smb.conf file from this master configuration and documentation file as shown here:

root#  testparm -s smb.conf.master > smb.conf

This administrative method makes it possible to maintain detailed configuration change records while at the same time keeping the workingsmb.conf file size to the minimum necessary.

List Shares Available on the Server

To list shares that are available from the configured Samba server, execute the following command:

$ smbclient -L yourhostname

You should see a list of shares available on your server. If you do not, then something is incorrectly configured. This method can also be used to see what shares are available on other SMB servers, such as Windows 2000.
If you choose user-level security, you may find that Samba requests a password before it will list the shares. See the smbclient man page for details. You can force it to list the shares without a password by adding the option -N to the command line.

Connect with a UNIX Client

Enter the following command:

$ smbclient  //yourhostname/aservice

Typically yourhostname is the name of the host on which smbd has been installed. The aservice is any service that has been defined in thesmb.conf file. Try your username if you just have a [homes] section in the smb.conf file.
Example: If the UNIX host is called bambi and a valid login name is fred, you would type:

$ smbclient //bambi/fred

Connect from a Remote SMB Client

Now that Samba is working correctly locally, you can try to access it from other clients. Within a few minutes, the Samba host should be listed in the Network Neighborhood on all Windows clients of its subnet. Try browsing the server from another client or "mounting" it.
Mounting disks from a DOS, Windows, or OS/2 client can be done by running a command such as:

C:\> net use m: \\servername\service

Where the drive letter m: is any available drive letter. It is important to double-check that the service (share) name that you used does actually exist.
Try printing, for example,

C:\> net use lpt1: \\servername\spoolservice

The spoolservice is the name of the printer (actually the print queue) on the target server. This will permit all print jobs that are captured by the lpt1: port on the Windows client to be sent to the printer that owns the spoolservice that has been specified.

C:\> print filename

What If Things Don't Work?

You might want to read The Samba Checklist. If you are still stuck, refer to Analyzing and Solving Samba Problems. Samba has been successfully installed at thousands of sites worldwide. It is unlikely that your particular problem is unique, so it might be productive to perform an Internet search to see if someone else has encountered your problem and has found a way to overcome it.
If you are new to Samba, and particularly if you are new to Windows networking, or to UNIX/Linux, the book “Samba-3 by Example” will help you to create a validated network environment. Simply choose from the first five chapters the network design that most closely matches site needs, then follow the simple step-by-step procedure to deploy it. Later, when you have a working network you may well want to refer back to this book for further insight into opportunities for improvement.



^^On most current distributions, Samba
user and password information are kept in tdb (trivial data base) Samba database files,
which can be edited and added to using the pdbedit command.^^

Samba:

Example Another simple smb.conf File

[global]

workgroup = MIDEARTH

[homes]

guest ok = no

read only = no

This will allow connections by anyone with an account on the server, using either their login name or homes as the service name. (Note: The workgroup that Samba should appear in must also be set. The default workgroup name is WORKGROUP.)
Make sure you put the smb.conf file in the correct place. Note, the correct location of this file depends on how the binary files were built. You can discover the correct location by executing from the directory that contains the smbd command file:

root#  smbd -b | grep smb.conf

Session Message Block

lets you share file systems, printers on a network with computers that use the Session Message Block (SMB)

protocol.

Step1 : yum install samba

Step 2: Creating samba shares. mkdir /softwares

Step 3: vi /etc/samba/smb.conf

[comp1-share]

comment = My Shares from Station1

path = /softwares

valid users = ashish

public = no

writable = yes

browseable = yes

Step 4: make a directory named /softwares and change others persmission to rwx.

[root@server1 ~]# mkdir /softwares

[root@server1 ~]# chmod o+w /softwares/

Step 5: Test configuration

testparm /etc/samba/smb.conf

Step 6: Adding User to samba share who can access samba share

smbpasswd -a ashish

[smbpasswd <user-name> <~~to modify user]

[Remember that ashish must exist in /etc/passwd]

Samba password is stored in passdb.tdb and secrets.tdb in /etc/samba directory.

Step 7: Starting SAMBA service

service smb start

chkconfig --level 345 smb on

Step 8: Listing samba shared information:

[root@server1 ~]# smbclient -L //192.168.1.3

Password: <<<~~~~~~ Press enter

Anonymous login successful

Domain=[MYGROUP] OS=[Unix] Server=[Samba 3.0.33-3.14.el5]

Sharename Type Comment

--------- ---- -------

comp1-share Disk My Shares from server1

IPC$ IPC IPC Service (Samba Server Version 3.0.33-

3.14.el5)

VICKY-PC\HP_LaserJet_1160:4 Printer \\VICKY-PC\HP LaserJet 1160

Microsoft_XPS_Document_Writer:1 Printer Microsoft XPS Document Writer

hp_business_inkjet_1200:5 Printer hp business inkjet 1200

Fax:2 Printer Fax

Adobe_PDF:3 Printer Adobe PDF

Anonymous login successful

Domain=[MYGROUP] OS=[Unix] Server=[Samba 3.0.33-3.14.el5]

Server Comment

--------- -------

SERVER1 Samba Server Version 3.0.33-3.14.el5

Workgroup Master

--------- -------

MYGROUP

[root@server1 ~]#

Following syntax can also be used to list what is shared with samba. In this case no password is asked.

[root@server1 ~]# smbclient -L 192.168.1.3 -U%

-L This option allows you to look at what services are available on a server.

Step 9:

Samba shared folder can be mounted in the following manners:

a)

Add the following line in /etc/fstab

//192.168.1.3/comp1-share /mnt cifs defaults,username=ashish 0 0

But in this case, on every reboot, the system will prompt you to enter valid password for ashish. To avoid this you can

follow the below method.

b)

Add the following line in /etc/fstab:

//192.168.1.3/comp1-share /mnt cifs defaults,credentials=/etc/cred.txt 0 0

Now, create a file /etc/cred.txt and add the following contents in it

username=ashish

password=ashish

c)

On windows it can be accessed as:

\\192.168.1.3\comp1-share

Errors:-

 NT_STATUS_LOGON_FAILURE

http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/problems.html
http://www.faqs.org/docs/securing/chap29sec284.html

SAMBA Interview Questions

Q: - Which SELinux security context used for SAMBA ?

samba_share_t

Q: - On which ports SAMBA server works ?

- UDP port 137 for netbios-ns, the NETBIOS Name Service
- UDP port 138 for netbios-dgm, the NETBIOS Datagram Service
- TCP port 139 for netbios-ssn, the NETBIOS session service
- TCP port 445 for microsoft-ds, the Microsoft Domain Service

Q: - What are the Secrity or Authentication Mode for SAMBA server?

ADS
DOMAIN
SERVER
USER
SHARE

Q: - How to Manually Create Machine Trust Accounts ?

/usr/sbin/useradd -g machines -d /var/lib/nobody -c "machine nickname" -s /bin/false machine_name$

passwd -l machine_name$

Q: - What are the SAMBA server Types ?

- Primary Domain Controller (PDC)
- Backup Domain Controller (BDC)
- ADS Domain Controller

Q: - Which protocol SAMBA server uses ?

SMB, which stands for Server Message Block, is a protocol for sharing files, printers, serial ports, and communications abstractions such as named pipes and mail slots between computers.

Q: - How Does a Workstation find its Domain Controller?

There are two different mechanisms to locate a domain controller: one
method is used when NetBIOS over TCP/IP is enabled and the other when
it has been disabled in the TCP/IP network configuration. Where NetBIOS over TCP/IP is disabled, all name resolution involves the use of DNS, broadcast messaging over UDP, as well as Active Directory communication technologies.

Q: - Can Samba Be a Backup Domain Controller to an NT4 PDC?

No. The native NT4 SAM replication protocols have not yet been fully implemented.

Q: - How Do I Replicate the smbpasswd File?

Replication of the smbpasswd file is sensitive. It has to be done whenever
changes to the SAM are made. Every user's password change is done in
the smbpasswd file and has to be replicated to the BDC. So replicating the
smbpasswd file very often is necessary.As the smbpasswd file contains plaintext password equivalents, it must not be sent unencrypted over the wire. The best way to set up smbpasswd replication from the PDC to the BDC is to use the utility rsync. rsync can use ssh as a transport. ssh itself can be set up to accept only rsync transfer without requiring the user to type a password.As said a few times before, use of this method is broken and awed. Machine trust accounts will go out of sync, resulting in a broken domain. This method is not recommended. Try using LDAP instead.

Q: - Can Samba fully replace my Windows NT server that is not a Primary Domain Controller (PDC)?

Samba can completely serve files and printers to Windows, just as a Windows NT server would.

Q2 Can Samba replaces my Windows NT PDC?

 Not completely. Samba domain control capabilities for a Windows 9x client are
 solid and complete, and so these clients would probably never know the difference. The domain control support for Windows NT/2000 clients is still being developed. Currently, enough has been implemented to allow a Windows NT client to join a Samba-controlled domain, but there is more to domain control than that. The most conspicuous absence is the lack of support for Windows NT trust relationships and the SAM replication protocol used between NT PDCs and Backup Domain Controllers (BDCs).

Q3 What TCP and UDP ports required for NetBIOS over TCP/IP use?

The NBT name service uses port 137/udp, the NBT session service uses port
139/tcp, and the NBT datagram service uses port 138/udp.

Q: -  How SMB protocol works?

There will be three stages in creating an SMB connection between a client and a specific share on a server.

The first stage in connecting to an SMB share is to negotiate the SMB protocol dialect to use. In the request packet, the client sends a text listing of all the SMB dialects that it understands. The server selects the most advanced protocol that it knows and responds to the client, specifying the protocol number from the list. At this point, the client and server have agreed that SMB commands can be used for the remainder of the conversation.

The second stage is to create a session connection between the client and server. To do this, the client issues a session setup request, which includes a sername and some proof of validity, such as a password. The server attempts to validate requesting user. If successful, the server then returns a session UID to client. This UID is unique for each session and has no relation to the server internal representation of users.

The third stage before access to files on a remote share is allowed is for the client to make a successful tree connection to the shared resource. The client sends to the server a tree connect request, which includes the UID previously issued by the server. At this stage the server verifies that the authenticated user is authorized to access the requested resource. If the user has sufficient privileges to access the share, the client is issued a tree connection ID (TID). The TID is used in all requests to access files contained in the resource to which the TID refers.

In this way SMB protocol works.

Q: - How man sections samba configuration file (smb.conf) contains?

smb.conf file contains three sections.

1. [global] Contains settings that determine Samba overall behavior.
2. [homes] A default share for providing a home directory for all users.
3. [printers] A default share for exporting all printers on the host via CIFS.

Q: - If a netbios name is not defined in smb.conf, than what will be netbios name?

If a netbios name is not defined, Samba will use the IP hostname of the server by default.

Q: -  I want to use User level security for my samba server than what i have to add in smb.conf file?

security = user

Q: -  How you will verify that your smb.conf file doesn’t have any mistakes and misspellings?

"testparm " tool that verifies the syntax of a configuration file(smb.conf).

testparm -s smb.conf

Q: -  What is the use of "smbclient" command?

"smbclient" is used to display the list of shares on your server. This verifies that smbd is running and functioning correctly. The -L option instructs smbclient to enumerate the shares on the server rather than actually connecting to one. The   -N switch instructs smbclient to use an anonymous login rather than the login name of the current user.
 

smbclient -L localhost -N

Antother use of "smbclient" command to connect the samba share.

smbclient //<server>/<share> -U <username>

Q: -  Explain "smbstatus" command?

The smbstatus utility displays information about connected users and currently locked files

Q: - Is it possible for Samba to share file systems that have been mounted using NFS?

Yes. However, this can be problematic if the NFS server that provides the file system fails, causing the Samba server to hang. It is always safer to use Samba to share a local file system.

Q: - How many simultaneous connections can a Samba server support?

In theory, there is no limit. In practice, the limit is determined by the server’s hardware, specifically the total amount of available RAM and the CPU power. It might also depend on the amount of activity from the smbd processes.

Q: - Can Samba be a member of more than one workgroup at the same time?

No, Samba can be a member of only one workgroup.

Q: - What is SWAT?

SWAT is GUI Based administration tool for samba server.

Q: - I am trying to use SWAT, but I keep getting the message There was no response. The server could be down or not responding. What is the problem?

The most likely cause is that SWAT is not listening to connections, or you have used the wrong URL in trying to connect to SWAT. SWAT usually lives behind port 901, so the URL you should use is http://ID_ADDRESS_OF_SERVER:901/

Q: - Can i set empty password for samba user?

yes, If you want to set the value to an empty password, you must change

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

to

NOPASSWORDXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

in your smbpasswd file.

Note: - if you have edited the smbpasswd file by hand, make sure that the LAN Manager and NT password fields contain exactly 32 characters, no more and no fewer. If these fields do not have exactly 32 characters, Samba will not be able to correctly read the entry.

or You can modify by "smbpasswd" command.

smbpasswd -n USER_NAME

Also you have to set the null passwords parameter to yes in the [global] section of smb.conf:

null passwords = yes

Q: - Does Samba support PAM?

Yes

Q: - What is role of "NTLM"?

The challenge/response authentication protocol available to Windows clients and servers for validating connection requests

Q: - Explain "force group" parameter used in smb.conf?

It will define the group id to be used for all file access in the place of the user’s primary group.

Q: - Explain "force user" parameter used in smb.conf?

It will define the user id to be used for all file access.

Q: - Explain "write list" parameter used in smb.conf?

A list of users and/or groups that should be given write access even if the read only parameter has been enabled.

Q: - My clients are getting the error message that the Disk is Full when trying to print to my Samba server, but there is plenty of space. What is the problem?

If smbd is unable to write the spooled file to the directory defined by the path parameter for a printer if the write permission were denied, for example it would respond to the client with the message, Disk is Full. Samba will also return this error message if the amount of free disk space in the spool directory has fallen below the value specified by the min print space parameter.

Q: - When I click on my Samba server in the network neighborhood, I am continually prompted for a password to the IPC$ share no matter what I enter.

The Windows client is attempting to use encrypted passwords. However, the Samba server is configured to support only clear-text passwords. You should either enable encrypted passwords on the server or enable clear-text passwords on the Windows client.

Q: - Why is security = domain better than security = server?

There are three reasons why security = domain is better. The first is because this method enables the Samba server to participate in domain trust relationships. This is impossible with server-level security. The second reason is that, under server-level security, each smbd process must keep an open connection with the authentication server. This can drain a Windows NT PDC quickly. Under domain-level security, this connection is maintained only long enough to perform the validation, thus conserving valuable resources. The final reason is that, as a domain member, the Samba server has access to much more information about user accounts, which can be used to automate the creation and deletion of user accounts upon demand.

Q: - what is nmbd daemon?

This daemon handles all name registration and resolution requests. It is the primary vehicle involved in network browsing. It handles all UDP-based protocols. The nmbd daemon should be the first command started as part of the Samba startup process.

Q: - What is smdb daemon?

This daemon handles all TCP/IP-based connection services for file- and print-based operations. It also manages local authentication. It should be started immediately following the startup of nmbd.

Q: - What is winbindd daemon?

This daemon should be started when Samba is a member of a Windows NT4 or ADS domain. It is also needed when Samba has trust relationships with another domain. The winbindd daemon will check the smb.conf file for the presence of the idmap uid and idmap gid  parameters. If they are found, winbindd will use the values specified for UID and GID allocation. If these parameters are not specified, winbindd  will start but it will not be able to allocate UIDs or GIDs.

Q: - Explain the parameter "wins support = Yes" used in smb.conf?

If the Samba server was configured to provide WINS support ("wins support = Yes"), then the WINS server is able to provide name resolution for all of the hosts that are not listed in the /etc/hosts file or within the DNS. Making this adjustment in the Name Service Switch configuration file (/etc/nsswitch.conf) allows the Linux system to query the WINS server for local name resolution. This saves manual adjustments to host files.

Q: - How to automate SMB share mounting during system startup?

Add smb share entry in /etc/fstab file.

//IP_ADDRESS_OF_SERVER/Shared   /shared    smbfs    noauto,defaults 0  0

Q: - how to start and stop samba server?

/etc/init.d/smb  restart