300-300 Practice Questions

A core feature of SSSD is its ability to cache user credentials (typically a hash of the password) and identity information (UID, GID, group memberships) locally. When a user successfully authenticates while online, SSSD caches this data. If the network connection to the identity provider is lost, SSSD can authenticate the user against the local cache, allowing for offline logins. This is controlled by the cache_credentials = true setting in sssd.conf, which is the default for most providers.

The testparm utility is specifically designed to parse and validate a smb.conf file. Running testparm (or testparm -s to suppress the full dump of service definitions and just show processing information) will report any syntax errors or invalid parameters. It is a critical first step before applying a new configuration to a production Samba server.

When Samba operates in a domain, it deals with Windows Security Identifiers (SIDs). The Linux kernel, however, understands User IDs (UIDs) and Group IDs (GIDs). The idmap_sss backend for Winbind allows Samba's winbindd process to communicate with the sssd daemon. SSSD, which is already handling identity information from FreeIPA (and any trusted domains), performs the authoritative mapping between SIDs and UIDs/GIDs. This ensures that Samba and the rest of the Linux system have a consistent view of user identities.

The create mask parameter defines the maximum permissions that are allowed when a file is created. It works by performing a bitwise AND with the permissions requested by the client. To enforce a minimum set of permissions, you should use force create mode, which performs a bitwise OR. However, the question asks to ensure permissions of 0640, which is often achieved by setting create mask and force create mode together. Among the given options, create mask is the parameter used to control permissions on file creation. If the goal is a strict 0640, one would typically use create mask = 0640 and force create mode = 0640. Given the choices, create mask = 0640 is the most relevant parameter for controlling file creation permissions. Correction: The best way to ensure minimum permissions is force create mode. However, create mask is the standard tool to limit permissions. A better interpretation for enforcing a specific mode is to use create mask to limit what the client can set and force create mode to add bits. In many contexts create mask is used to define the final permissions. Let's reconsider. force create mode adds permissions. create mask removes permissions. To get exactly 0640, you would set create mask = 0777 and force create mode = 0640. No, that's not right. The final permissions are (mode | force create mode) & create mask. To guarantee 0640, you would use force create mode = 0640 and create mask = 0640. Since only one is an option, let's re-evaluate the common usage. create mask is used to set the permissions on creation, similar to umask. force create mode is used to ensure certain bits are always set. The most direct answer to set the mode is create mask. Let's assume the client requests 0666. 0666 & 0640 results in 0640. This works. force create mode would add bits, which isn't what's asked. Therefore, create mask is the correct answer to define the permissions on creation.

This is the correct, modern approach for integrating a Samba server with a FreeIPA domain without a full AD trust. Enrolling the server as an IPA client provides Kerberos and identity information via SSSD. Configuring Samba with security = ads (which works for any Kerberos realm) and the idmap_sss backend allows Samba to directly and efficiently leverage SSSD for SID-to-UID/GID mapping. This avoids data migration, eliminates local passwords, and allows share permissions to be managed with central FreeIPA groups, meeting all requirements.

The vfs objects = recycle parameter enables the recycle bin functionality. To meet the requirement of storing deleted files in a user-specific home directory location with a date stamp, the recycle:repository path must be constructed using Samba variables. /home/%U/recycle_bin/%d correctly uses %U for the username and %d for the current date, placing the recycled files on the separate storage tier where home directories reside. The other options either use a centralized repository, a relative path within the share, or incorrectly use the shadow_copy2 module which is for versioning, not a recycle bin.

The use_fully_qualified_names parameter controls whether SSSD returns qualified or non-qualified user names. Setting it to false allows users to log in with their short names. The domain part is still implicitly managed by SSSD's domain configuration, ensuring that lookups are directed to the correct FreeIPA domain. re_expression is for filtering, default_domain_suffix appends a domain, and full_name_format controls how the GECOS field is constructed, not the login name format.

This scenario requires identities from one Kerberos realm (FreeIPA) to be authenticated by a service in another realm (the Samba server in AD). This is the primary use case for a cross-realm trust. By establishing a trust, the AD domain controllers can validate Kerberos tickets issued by the FreeIPA KDC, allowing staff members to access resources in the student domain. SSSD is involved on the client side, but the fundamental enabling technology is the trust relationship. A FreeIPA replica cannot be placed in an AD domain.

sec=krb5 explicitly tells mount.cifs to use Kerberos v5 authentication. It will use the ticket from the user's ccache.

sec=krb5i specifies Kerberos v5 authentication with packet integrity signing, which is a more secure variant. The multi-user option is also commonly used in this context but not strictly required for Kerberos itself.

In a modern FreeIPA environment, the traditional rpc.idmapd daemon is often replaced by SSSD's capabilities. SSSD can handle the translation between NFSv4's user@domain string principals and the local system's numeric UID/GIDs. This provides a centralized and consistent mapping source, which is crucial in an identity-managed environment like FreeIPA. The other options are either legacy methods or not directly related to NFSv4 ID mapping.