300-300 Sample Questions & Answers

The veto files parameter instructs Samba to hide files and directories that match the specified patterns, making them invisible and inaccessible to SMB clients, regardless of filesystem permissions. If a pattern in this list inadvertently matches legitimate files, they will disappear from the users' view. hide unreadable hides files the user cannot read, but the scenario states they have read permissions. dont descend applies to directories, and case sensitive = yes affects name matching, not visibility.

True. The ad_access_filter parameter allows an administrator to specify a custom LDAP filter that is evaluated against the user object in Active Directory during the access control phase. A common use case is to restrict logins to members of a specific AD group, for example: ad_access_filter = (memberOf=cn=LinuxUsers,ou=Groups,dc=example,dc=com). This is a powerful method for controlling access to Linux systems from Active Directory.

FreeIPA includes a compatibility tree and services to respond to NIS client requests. This functionality must be explicitly enabled. This can be done during the initial server installation by answering 'yes' to configuring the NIS domain and server, or by passing the --setup-nis flag to ipa-server-install. This configures the schema and starts the necessary services (ypserv) to serve NIS maps from the FreeIPA LDAP backend.

Most Samba command-line tools, including samba-tool, use the -d or --debuglevel= option to control the verbosity of logging output. A debug level of 10 provides the maximum amount of detail, which is essential for diagnosing complex issues during processes like domain provisioning. --verbose is a common flag in many Linux utilities but is not the primary mechanism for detailed debugging in Samba. --log-stdout redirects logs but does not set the level, and --show-progress only affects progress indicators.

This solution meets all requirements. Deploying FreeIPA and establishing a trust with AD allows for consolidated identity management while respecting the constraint that AD remains primary. Linux clients authenticating against FreeIPA (via SSSD) can leverage its centralized management for sudo and automount maps. Because of the trust, AD users can authenticate to IPA-enrolled clients and services. The Samba server, joined to the IPA realm, can authenticate both IPA and trusted AD users and can be configured to support Windows ACLs (vfs_acl_xattr). This eliminates the need for OpenLDAP and the local smbpasswd file.

Samba stores Windows ACLs in extended attributes (xattrs) on the Linux filesystem. The filesystem must be mounted with support for user extended attributes (user_xattr) and POSIX ACLs (acl) to store and process this information correctly.

The acl_xattr VFS module is responsible for the translation layer between Windows Security Descriptors (ACLs) and the POSIX ACLs and extended attributes stored on the filesystem. This module must be enabled for the share.

SSSD provides several services, including authentication (pam) and identity lookups (nss). If the nss service is not enabled in the main [sssd] section, the system's Name Service Switch cannot use SSSD to look up user information, including supplementary group memberships. Authentication may still succeed via PAM, but commands like id and getent group will not be able to retrieve the full group list from SSSD. The other options relate to schema mapping or token groups, which are less likely to be the primary cause for a complete lack of secondary groups.

The smbclient command can be run non-interactively by using the -c or --command option followed by a string of commands to execute. smbclient -c 'ls' //fileserv/data will authenticate, execute the ls command within the share's context to list its contents, and then exit. The -L option is used to list all shares on a server, not the contents of a specific share.

Host-Based Access Control (HBAC) is a core feature of FreeIPA that defines a policy combining who (users/groups), where (which client hosts), and what (which services like sshd, login, etc.) are allowed. It provides a centralized way to enforce login and service access policies across all IPA-enrolled clients. It does not replace sudo for command elevation but works alongside it to control initial access.

To integrate Samba with CUPS dynamically, you must set the printing backend with printing = cups. Then, printcap name = cups tells Samba to query the CUPS server for the list of available printers, rather than reading a static /etc/printcap file. This combination allows any printer added to CUPS to automatically become visible as a share on the Samba server.