# Install Samba packages (RHEL/CentOS/Fedora)
sudo dnf install samba samba-common samba-client -y

# Create a shared directory
sudo mkdir -p /srv/samba/shared
sudo chmod 2775 /srv/samba/shared

# Add a Samba user
sudo smbpasswd -a username

# Start and enable Samba services
sudo systemctl start smb nmb
sudo systemctl enable smb nmb

# Open firewall ports
sudo firewall-cmd --permanent --add-service=samba
sudo firewall-cmd --reload

# Check Samba version and compiled options
smbd --version
# Output: Version 4.15.5

# View Samba build information
smbd -b | head -20
# Displays compilation options and supported features

# Check SMB protocol versions supported
smbclient -L localhost -N | grep -i protocol
# Shows available SMB protocol versions

# List all Samba-related packages
rpm -qa | grep samba | sort
# Shows installed Samba packages and versions

# Check Samba configuration file location
rpm -ql samba-common | grep smb.conf
# Output: /etc/samba/smb.conf

# Verify Samba daemon files
rpm -ql samba | grep -E "smbd|nmbd"
# Lists daemon executables and service files

# Check Samba client utilities
rpm -ql samba-client | grep bin/
# Shows available client commands

# Capture SMB traffic for analysis (requires tcpdump)
sudo tcpdump -i eth0 -w smb_capture.pcap port 445 or port 139
# Captures SMB network traffic for analysis

# View active Samba connections
sudo smbstatus
# Displays connected clients and open files

# Check Samba listening ports
sudo netstat -tulpn | grep -E 'smbd|nmbd'
# Shows active Samba service listeners

# Test SMB connection to localhost
smbclient -L localhost -U username
# Lists available shares on local server

# Set maximum SMB protocol version in configuration
sudo tee -a /etc/samba/smb.conf << 'EOF'
[global]
    server max protocol = SMB3
    server min protocol = SMB2
    client max protocol = SMB3
    client min protocol = SMB2
EOF

# Test configuration syntax
sudo testparm -s
# Validates configuration file without comments

# Restart Samba to apply protocol settings
sudo systemctl restart smb nmb

# Verify protocol settings are active
sudo smbstatus --shares
# Shows active connections with protocol versions

# Configure authentication settings
sudo tee /etc/samba/smb.conf.d/auth.conf << 'EOF'
[global]
    # Require encrypted passwords
    encrypt passwords = yes
    
    # Authentication methods
    ntlm auth = mschapv2-and-ntlmv2-only
    client ntlmv2 auth = yes
    
    # Disable weak authentication
    lanman auth = no
    client lanman auth = no
EOF

# Include additional configuration
sudo sed -i '/\[global\]/a include = /etc/samba/smb.conf.d/auth.conf' /etc/samba/smb.conf

# Validate authentication configuration
sudo testparm --parameter-name='encrypt passwords'
# Output: yes

# Test authentication from client
smbclient //server/share -U username
# Prompts for password and establishes connection

# Configure NetBIOS settings
sudo tee -a /etc/samba/smb.conf << 'EOF'
[global]
    # NetBIOS configuration
    netbios name = LINUXSERVER
    workgroup = WORKGROUP
    wins support = yes
    dns proxy = yes
EOF

# Test NetBIOS name resolution
nmblookup -S LINUXSERVER
# Shows NetBIOS information for server

# Query NetBIOS names on network
sudo nmblookup -A 192.168.1.100
# Lists NetBIOS names for specific IP

# Verify WINS server functionality
nmblookup -U 192.168.1.100 -R HOSTNAME
# Tests name resolution through WINS

# Configure user-level security (recommended)
sudo tee -a /etc/samba/smb.conf << 'EOF'
[global]
    security = user
    passdb backend = tdbsam
    map to guest = bad user
EOF

# Create Samba user database
sudo pdbedit -L
# Lists Samba users in database

# Add detailed user information
sudo pdbedit -Lv username
# Shows verbose user details

# Export user database for backup
sudo pdbedit -e smbpasswd:/backup/smbpasswd.bak
# Exports to legacy format

# Import users from backup
sudo pdbedit -i smbpasswd:/backup/smbpasswd.bak
# Restores user database

# Evaluate Samba performance metrics
sudo smbstatus --profile
# Shows performance statistics and connection info

# Monitor file transfer rates
watch -n 1 'sudo smbstatus | grep -A 5 "Service"'
# Real-time monitoring of active connections

# Check server load from Samba
sudo systemctl status smb nmb
# Shows service status and resource usage

# Analyze Samba log for performance issues
sudo tail -f /var/log/samba/log.smbd | grep -i performance
# Real-time log monitoring for performance events

# Enable SMB encryption for shares
sudo tee -a /etc/samba/smb.conf << 'EOF'
[secure_share]
    path = /srv/samba/secure
    smb encrypt = required
    valid users = @securegroup
    read only = no
EOF

# Configure audit logging
sudo tee -a /etc/samba/smb.conf << 'EOF'
[global]
    full_audit:prefix = %u|%I|%m|%S
    full_audit:success = mkdir rename unlink rmdir open
    full_audit:failure = none
    full_audit:facility = local5
    full_audit:priority = notice
EOF

# Enable VFS audit module
sudo tee -a /etc/samba/smb.conf << 'EOF'
[audited_share]
    vfs objects = full_audit
    path = /srv/samba/audited
EOF

# Restart Samba to apply security settings
sudo systemctl restart smb

# Verify encryption is active
sudo smbstatus --encryption
# Shows encryption status for connections

# Check Samba resource consumption
sudo systemctl status smb nmb --no-pager
# Shows CPU and memory usage

# Monitor disk I/O for Samba shares
sudo iotop -p $(pidof smbd) -o
# Displays disk I/O by Samba processes

# Analyze network bandwidth usage
sudo iftop -f "port 445 or port 139"
# Shows network traffic for SMB ports

# Generate resource utilization report
sudo smbstatus --shares --processes | tee samba_report.txt
# Creates detailed status report

# Configure connection limits
sudo tee -a /etc/samba/smb.conf << 'EOF'
[global]
    max connections = 1000
    max smbd processes = 500
    deadtime = 15
    keepalive = 60
EOF

# Optimize for high-connection environments
sudo tee -a /etc/samba/smb.conf << 'EOF'
[global]
    socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=131072 SO_SNDBUF=131072
    use sendfile = yes
    write cache size = 262144
    min receivefile size = 16384
EOF

# Monitor concurrent connections
watch -n 5 'sudo smbstatus | grep -c "^[0-9]"'
# Counts active connections every 5 seconds

# Test maximum connection capacity
for i in {1..100}; do
    smbclient //server/share -U user%pass -c "ls" &
done
wait
# Stress tests with 100 concurrent connections

# Update package repositories
sudo dnf update -y

# Install Samba server packages
sudo dnf install samba samba-common samba-client -y

# Install additional utilities (optional)
sudo dnf install samba-winbind samba-winbind-clients -y

# Verify installation
rpm -qa | grep samba | sort
# Lists all installed Samba packages

# Check Samba version
smbd --version
# Output: Version 4.15.5

# Verify package files
rpm -ql samba | grep -E 'bin|sbin' | head -10
# Lists installed executables

# Update package index
sudo apt update

# Install Samba packages
sudo apt install samba samba-common-bin smbclient cifs-utils -y

# Install additional components
sudo apt install samba-vfs-modules python3-samba -y

# Verify installation
dpkg -l | grep samba
# Shows installed Samba packages

# Check service status
sudo systemctl status smbd nmbd
# Verifies services are installed

# Locate configuration files
dpkg -L samba-common | grep conf
# Lists configuration file locations

# Examine samba package contents
rpm -ql samba | head -20
# Shows first 20 files from package

# List configuration files
rpm -qc samba samba-common
# Shows configuration files only

# View documentation files
rpm -qd samba | grep -E 'pdf|html|txt'
# Lists documentation resources

# Check service unit files
rpm -ql samba | grep systemd
# Shows systemd service definitions

# List binary executables
rpm -ql samba | grep -E '/usr/sbin|/usr/bin'
# Shows installed commands

# Backup original configuration
sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.original

# View default configuration
sudo cat /etc/samba/smb.conf | grep -v '^#' | grep -v '^;' | grep -v '^$'
# Shows active configuration without comments

# Create configuration directory structure
sudo mkdir -p /etc/samba/smb.conf.d
sudo mkdir -p /etc/samba/private
sudo chmod 700 /etc/samba/private

# Set proper ownership
sudo chown -R root:root /etc/samba
sudo chmod 644 /etc/samba/smb.conf

# Verify configuration permissions
ls -la /etc/samba/
# Shows file permissions and ownership

# Check Samba services status
sudo systemctl status smb nmb --no-pager
# Shows current service state

# Enable services at boot
sudo systemctl enable smb nmb
# Creates symlinks for automatic startup

# Verify service enablement
sudo systemctl is-enabled smb nmb
# Output: enabled for both services

# Check service unit files
sudo systemctl cat smb.service
# Displays service configuration

# View service dependencies
sudo systemctl list-dependencies smb.service
# Shows required services and targets

# Check if services are masked
sudo systemctl is-active smb nmb
# Output: active or inactive

# Create comprehensive global configuration
sudo tee /etc/samba/smb.conf << 'EOF'
[global]
    # Server identity
    workgroup = WORKGROUP
    server string = Samba Server %v on %L
    netbios name = LINUXSERVER
    
    # Protocol settings
    server max protocol = SMB3
    server min protocol = SMB2
    client max protocol = SMB3
    
    # Security settings
    security = user
    passdb backend = tdbsam
    encrypt passwords = yes
    map to guest = never
    
    # Performance optimization
    socket options = TCP_NODELAY IPTOS_LOWDELAY
    use sendfile = yes
    write cache size = 262144
    
    # Logging configuration
    log file = /var/log/samba/log.%m
    max log size = 50
    log level = 1
    
    # Miscellaneous settings
    load printers = no
    printing = bsd
    printcap name = /dev/null
    disable spoolss = yes
EOF

# Validate configuration syntax
sudo testparm
# Checks for errors and displays configuration

# Test specific parameters
sudo testparm --parameter-name='workgroup'
# Output: WORKGROUP

# Identify available network interfaces
ip addr show | grep -E '^[0-9]+:|inet '
# Lists interfaces with IP addresses

# Configure interface binding
sudo tee -a /etc/samba/smb.conf << 'EOF'
[global]
    interfaces = lo eth0 192.168.1.0/24
    bind interfaces only = yes
    hosts allow = 192.168.1.0/24 127.0.0.1
    hosts deny = 0.0.0.0/0
EOF

# Validate network configuration
sudo testparm --parameter-name='interfaces'
# Shows configured interfaces

# Restart services to apply changes
sudo systemctl restart smb nmb

# Verify listening interfaces
sudo netstat -tulpn | grep -E 'smbd|nmbd'
# Shows active listeners on configured interfaces

# Test connectivity from specific interface
sudo ss -tlnp | grep :445
# Displays TCP listeners on SMB port

# Configure name resolution
sudo tee -a /etc/samba/smb.conf << 'EOF'
[global]
    # DNS configuration
    dns proxy = yes
    name resolve order = wins hosts bcast
    
    # WINS settings
    wins support = yes
    wins server = 192.168.1.1
    
    # NetBIOS configuration
    netbios name = LINUXSERVER
    netbios aliases = FILESERVER STORAGE
EOF

# Update lmhosts file for static mappings
sudo tee /etc/samba/lmhosts << 'EOF'
127.0.0.1   localhost
192.168.1.100   LINUXSERVER
192.168.1.101   BACKUP
EOF

# Test name resolution
nmblookup LINUXSERVER
# Should return IP address

# Query all NetBIOS names
nmblookup -A 192.168.1.100
# Lists NetBIOS names for IP

# Verify WINS functionality
nmblookup -U 192.168.1.1 -R LINUXSERVER
# Tests WINS server resolution

# Configure character encoding
sudo tee -a /etc/samba/smb.conf << 'EOF'
[global]
    unix charset = UTF-8
    dos charset = CP850
    display charset = UTF-8
EOF

# Set server timezone
sudo timedatectl set-timezone America/New_York

# Verify timezone setting
timedatectl status | grep "Time zone"
# Output: Time zone: America/New_York (EST, -0500)

# Configure time server for synchronization
sudo tee -a /etc/samba/smb.conf << 'EOF'
[global]
    time server = yes
EOF

# Restart Samba with new settings
sudo systemctl restart smb nmb

# Test time synchronization
net time \\LINUXSERVER
# Should display current server time

# First, create Linux system user
sudo useradd -m -s /sbin/nologin smbuser1
# Creates user without shell access

# Set Linux password (required for system)
echo "smbuser1:LinuxPass123" | sudo chpasswd

# Add user to Samba database
sudo smbpasswd -a smbuser1
# Prompts for Samba password (can differ from Linux password)

# Enable Samba account
sudo smbpasswd -e smbuser1
# Activates the account

# Verify user creation
sudo pdbedit -L
# Lists all Samba users

# View detailed user information
sudo pdbedit -Lv smbuser1
# Shows verbose user details

# List all users with detailed information
sudo pdbedit -Lw
# Shows users in smbpasswd format

# Create user with specific home directory
sudo useradd -m -d /home/users/john -s /sbin/nologin john
sudo smbpasswd -a john

# Change user password
sudo smbpasswd john
# Prompts for new password

# Disable user account
sudo smbpasswd -d john
# Temporarily disables without deletion

# Re-enable disabled account
sudo smbpasswd -e john
# Reactivates the account

# Delete Samba user (keeps Linux user)
sudo smbpasswd -x john
# Removes from Samba database only

# Delete both Linux and Samba user
sudo smbpasswd -x john
sudo userdel -r john
# Completely removes user

# Create Linux group for Samba users
sudo groupadd smbusers
sudo groupadd smbadmins

# Add users to groups
sudo usermod -aG smbusers smbuser1
sudo usermod -aG smbadmins admin1

# Verify group membership
groups smbuser1
# Output: smbuser1 : smbuser1 smbusers

# Create shared directory with group ownership
sudo mkdir -p /srv/samba/team
sudo chgrp smbusers /srv/samba/team
sudo chmod 2775 /srv/samba/team

# Set ACLs for fine-grained control
sudo setfacl -R -m g:smbusers:rwx /srv/samba/team
sudo setfacl -R -m d:g:smbusers:rwx /srv/samba/team

# Verify ACLs
getfacl /srv/samba/team
# Shows detailed permissions

# List all Samba-related groups
getent group | grep smb
# Displays groups with smb in name

# Set password complexity requirements in PAM
sudo tee /etc/security/pwquality.conf << 'EOF'
minlen = 12
dcredit = -1
ucredit = -1
lcredit = -1
ocredit = -1
EOF

# Configure password expiration
sudo chage -M 90 -W 14 smbuser1
# Password expires after 90 days, warns 14 days before

# View password aging information
sudo chage -l smbuser1
# Shows password expiration details

# Force password change at next login
sudo smbpasswd -e smbuser1
sudo passwd -e smbuser1

# Set account expiration date
sudo chage -E 2025-12-31 smbuser1
# Account expires on specified date

# Verify user status
sudo pdbedit -Lv smbuser1 | grep -i "Account"
# Shows account status information

# Create user list file
cat > /tmp/samba_users.txt << 'EOF'
user1:Password1
user2:Password2
user3:Password3
EOF

# Script to create multiple users
while IFS=: read -r username password; do
    # Create Linux user
    sudo useradd -m -s /sbin/nologin "$username"
    
    # Set Linux password
    echo "$username:$password" | sudo chpasswd
    
    # Add to Samba with password
    printf "%s\n%s\n" "$password" "$password" | sudo smbpasswd -a -s "$username"
    
    # Enable account
    sudo smbpasswd -e "$username"
    
    echo "Created user: $username"
done < /tmp/samba_users.txt

# Verify all users created
sudo pdbedit -L
# Shows all Samba users

# Clean up sensitive file
sudo shred -vfz /tmp/samba_users.txt
# Securely deletes password file

# Create shared directory structure
sudo mkdir -p /srv/samba/public
sudo mkdir -p /srv/samba/secure
sudo mkdir -p /srv/samba/team

# Set directory permissions
sudo chmod 2775 /srv/samba/public
sudo chmod 2770 /srv/samba/secure
sudo chmod 2775 /srv/samba/team

# Set ownership
sudo chown nobody:nogroup /srv/samba/public
sudo chown root:smbadmins /srv/samba/secure
sudo chown root:smbusers /srv/samba/team

# Configure public share
sudo tee -a /etc/samba/smb.conf << 'EOF'
[public]
    path = /srv/samba/public
    comment = Public File Share
    browseable = yes
    writable = yes
    guest ok = yes
    create mask = 0664
    directory mask = 2775
    force create mode = 0664
    force directory mode = 2775
EOF

# Test configuration
sudo testparm -s | grep -A 10 "\[public\]"
# Shows public share configuration

# Configure authenticated secure share
sudo tee -a /etc/samba/smb.conf << 'EOF'
[secure]
    path = /srv/samba/secure
    comment = Secure Administrative Share
    browseable = no
    writable = yes
    valid users = @smbadmins admin1 admin2
    write list = @smbadmins
    read list = 
    create mask = 0660
    directory mask = 2770
    force create mode = 0660
    force directory mode = 2770
    hide dot files = yes
    veto files = /*.exe/*.com/*.bat/
EOF

# Configure team collaboration share
sudo tee -a /etc/samba/smb.conf << 'EOF'
[team]
    path = /srv/samba/team
    comment = Team Collaboration Area
    browseable = yes
    writable = yes
    valid users = @smbusers
    force group = smbusers
    create mask = 0664
    directory mask = 2775
    inherit permissions = yes
    inherit acls = yes
EOF

# Reload Samba configuration
sudo systemctl reload smb
# Applies new share definitions

# List all configured shares
sudo smbclient -L localhost -N
# Shows available shares

# Configure read-only documentation share
sudo mkdir -p /srv/samba/docs
sudo chmod 2755 /srv/samba/docs
sudo chown root:smbusers /srv/samba/docs

sudo tee -a /etc/samba/smb.conf << 'EOF'
[documentation]
    path = /srv/samba/docs
    comment = Company Documentation
    browseable = yes
    read only = yes
    guest ok = yes
    create mask = 0644
    directory mask = 0755
    vfs objects = recycle
    recycle:repository = .recycle
    recycle:keeptree = yes
    recycle:versions = yes
EOF

# Test read-only access
smbclient //localhost/documentation -U guest
# Attempts to create file should fail

# Verify recycle bin functionality
sudo ls -la /srv/samba/docs/.recycle/
# Shows recycled files

# Configure home directory sharing
sudo tee -a /etc/samba/smb.conf << 'EOF'
[homes]
    comment = Home Directories
    browseable = no
    writable = yes
    valid users = %S
    create mask = 0600
    directory mask = 0700
    hide dot files = yes
    follow symlinks = no
EOF

# Set proper permissions on home directories
sudo chmod 700 /home/smbuser1
sudo chown smbuser1:smbuser1 /home/smbuser1

# Test home directory access
smbclient //localhost/smbuser1 -U smbuser1
# Should access user's home directory

# List user's home share
smbclient -L localhost -U smbuser1
# Shows personal share

# Configure share with versioning
sudo tee -a /etc/samba/smb.conf << 'EOF'
[versioned]
    path = /srv/samba/versioned
    comment = Versioned File Share
    browseable = yes
    writable = yes
    valid users = @smbusers
    
    # Shadow copy configuration
    vfs objects = shadow_copy2
    shadow:snapdir = .snapshots
    shadow:basedir = /srv/samba/versioned
    shadow:sort = desc
    shadow:format = GMT-%Y.%m.%d-%H.%M.%S
    shadow:localtime = yes
    
    # Audit logging
    vfs objects = full_audit shadow_copy2
    full_audit:prefix = %u|%I|%m|%S
    full_audit:success = mkdir rmdir open rename unlink write pwrite
    full_audit:failure = connect
    full_audit:facility = local5
    full_audit:priority = notice
EOF

# Create snapshot directory
sudo mkdir -p /srv/samba/versioned/.snapshots

# Reload configuration
sudo systemctl reload smb

# Test versioned access
smbclient //localhost/versioned -U smbuser1 -c "ls"
# Lists files including previous versions

# Check firewalld status
sudo systemctl status firewalld
# Should show active (running)

# View current firewall configuration
sudo firewall-cmd --list-all
# Shows active rules and services

# Add Samba service to default zone
sudo firewall-cmd --permanent --add-service=samba
sudo firewall-cmd --permanent --add-service=samba-client

# Alternative: Add individual ports
sudo firewall-cmd --permanent --add-port=445/tcp
sudo firewall-cmd --permanent --add-port=139/tcp
sudo firewall-cmd --permanent --add-port=137/udp
sudo firewall-cmd --permanent --add-port=138/udp

# Reload firewall rules
sudo firewall-cmd --reload

# Verify rules are active
sudo firewall-cmd --list-services
# Should show samba and samba-client

# Check specific port status
sudo firewall-cmd --query-port=445/tcp
# Output: yes (if enabled)

# Create custom zone for internal network
sudo firewall-cmd --permanent --new-zone=internal-net
sudo firewall-cmd --reload

# Add internal network to zone
sudo firewall-cmd --permanent --zone=internal-net --add-source=192.168.1.0/24
sudo firewall-cmd --permanent --zone=internal-net --add-service=samba

# Restrict external access
sudo firewall-cmd --permanent --zone=public --remove-service=samba
sudo firewall-cmd --reload

# Verify zone configuration
sudo firewall-cmd --zone=internal-net --list-all
# Shows internal-net zone configuration

# Test from allowed network
smbclient -L 192.168.1.100 -U username
# Should succeed from 192.168.1.0/24

# Log dropped packets for monitoring
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule service name="samba" log prefix="SMB-DROP" level="info" limit value="5/m" drop'
sudo firewall-cmd --reload

# View dropped connection attempts
sudo journalctl -f | grep "SMB-DROP"
# Shows real-time firewall drops

# For systems using iptables directly
# Insert rules before REJECT rules

# Allow Samba from local network
sudo iptables -I INPUT -p tcp --dport 445 -s 192.168.1.0/24 -j ACCEPT
sudo iptables -I INPUT -p tcp --dport 139 -s 192.168.1.0/24 -j ACCEPT
sudo iptables -I INPUT -p udp --dport 137 -s 192.168.1.0/24 -j ACCEPT
sudo iptables -I INPUT -p udp --dport 138 -s 192.168.1.0/24 -j ACCEPT

# Save rules
sudo service iptables save
# Or on newer systems:
sudo iptables-save > /etc/sysconfig/iptables

# View current rules
sudo iptables -L -n -v | grep -E '445|139|137|138'
# Shows Samba-related rules

# Test connectivity
sudo nc -zv localhost 445
# Output: Connection to localhost 445 port [tcp/microsoft-ds] succeeded!

# Configure hosts.allow for permitted hosts
sudo tee -a /etc/hosts.allow << 'EOF'
# Samba access control
smbd: 192.168.1.0/255.255.255.0
nmbd: 192.168.1.0/255.255.255.0
smbd: 10.0.0.0/255.0.0.0
nmbd: 10.0.0.0/255.0.0.0
EOF

# Deny all others in hosts.deny
sudo tee -a /etc/hosts.deny << 'EOF'
# Deny all other Samba access
smbd: ALL
nmbd: ALL
EOF

# Test TCP wrapper configuration
sudo tcpdmatch smbd 192.168.1.50
# Should show: access granted

sudo tcpdmatch smbd 203.0.113.50
# Should show: access denied

# Verify wrapper integration in smb.conf
sudo tee -a /etc/samba/smb.conf << 'EOF'
[global]
    hosts allow = 192.168.1.0/24 10.0.0.0/8 127.0.0.1
    hosts deny = 0.0.0.0/0
EOF

# Restart Samba to apply changes
sudo systemctl restart smb nmb

# Check SELinux status
sudo getenforce
# Output: Enforcing (should be Enforcing for security)

# List all Samba-related booleans
sudo getsebool -a | grep samba
# Shows available Samba booleans

# Common Samba booleans and their purposes
sudo setsebool -P samba_enable_home_dirs on
# Allows access to home directories

sudo setsebool -P samba_export_all_rw on
# Permits read/write to all shares

sudo setsebool -P samba_export_all_ro on
# Permits read-only to all shares

sudo setsebool -P samba_share_nfs on
# Allows sharing NFS mounts via Samba

# Verify boolean status
sudo getsebool samba_enable_home_dirs
# Output: samba_enable_home_dirs --> on

# View current file contexts
ls -Z /srv/samba/
# Shows SELinux contexts for directories

# Set Samba share context
sudo semanage fcontext -a -t samba_share_t "/srv/samba/public(/.*)?"
sudo semanage fcontext -a -t samba_share_t "/srv/samba/team(/.*)?"
sudo semanage fcontext -a -t samba_share_t "/srv/samba/secure(/.*)?"

# Apply contexts to filesystem
sudo restorecon -Rv /srv/samba/
# Recursively applies correct contexts

# Verify contexts applied correctly
ls -Z /srv/samba/
# Should show samba_share_t for directories

# For home directory sharing
sudo semanage fcontext -a -t samba_share_t "/home/[^/]+/sambashare(/.*)?"
sudo restorecon -Rv /home/*/sambashare/

# Check for SELinux denials
sudo ausearch -m avc -ts recent | grep samba
# Shows recent Samba-related denials

# Generate policy from denials
sudo ausearch -m avc -ts recent | audit2allow -M samba_custom
# Creates samba_custom.te and samba_custom.pp

# Review proposed policy
cat samba_custom.te
# Shows policy rules

# Install custom policy
sudo semodule -i samba_custom.pp

# Verify policy installation
sudo semodule -l | grep samba
# Shows all Samba-related policies

# Test Samba functionality
smbclient //localhost/public -U guest -c "ls"
# Should work without SELinux denials

# Monitor for new denials
sudo tail -f /var/log/audit/audit.log | grep samba
# Real-time monitoring of Samba SELinux events

# View current Samba port labels
sudo semanage port -l | grep samba
# Shows labeled ports for Samba

# Add custom port for Samba
sudo semanage port -a -t samba_port_t -p tcp 44500

# Verify port label
sudo semanage port -l | grep 44500
# Output: 44500/tcp   samba_port_t

# Configure Samba to use custom port
sudo tee -a /etc/samba/smb.conf << 'EOF'
[global]
    smb ports = 44500 139
EOF

# Restart Samba
sudo systemctl restart smb

# Verify Samba listening on custom port
sudo netstat -tulpn | grep :44500
# Should show smbd listening

# Update firewall for custom port
sudo firewall-cmd --permanent --add-port=44500/tcp
sudo firewall-cmd --reload

# From Windows Run dialog (Win+R), enter:
\\LINUXSERVER\public

# Or use IP address:
\\192.168.1.100\public

# Map network drive via Command Prompt:
net use Z: \\LINUXSERVER\public /persistent:yes

# Authenticate with specific user:
net use Z: \\LINUXSERVER\secure /user:username password

# View mapped drives:
net use

# Disconnect mapped drive:
net use Z: /delete

# List available shares
Get-SmbShare -CimSession LINUXSERVER

# Connect to share
New-SmbMapping -LocalPath Z: -RemotePath \\LINUXSERVER\public -Persistent $true

# Test connectivity
Test-NetConnection -ComputerName LINUXSERVER -Port 445

# View current connections
Get-SmbConnection

# Remove mapping
Remove-SmbMapping -LocalPath Z: -Force

# Monitor active connections from server
sudo smbstatus
# Shows connected users and accessed shares

# View detailed connection information
sudo smbstatus --shares
# Lists open files and shares in use

# Show connections from specific client
sudo smbstatus | grep "192.168.1.150"
# Filters to specific IP address

# Monitor authentication attempts
sudo tail -f /var/log/samba/log.smbd | grep -i auth
# Real-time authentication monitoring

# Check for failed login attempts
sudo grep -i "failed" /var/log/samba/*.log
# Shows authentication failures

# List shares on remote server
smbclient -L //LINUXSERVER -U username
# Prompts for password

# Anonymous share listing
smbclient -L //LINUXSERVER -N
# Uses guest account

# Connect to specific share
smbclient //LINUXSERVER/public -U username
# Opens interactive prompt

# Execute commands non-interactively
smbclient //LINUXSERVER/public -U username -c "ls; get file.txt"
# Lists files and downloads file.txt

# Upload file to share
smbclient //LINUXSERVER/public -U username -c "put localfile.txt remotefile.txt"

# Create directory on share
smbclient //LINUXSERVER/team -U username -c "mkdir newdir"

# Recursively download directory
smbclient //LINUXSERVER/public -U username -c "recurse; prompt; mget *"

# Install CIFS utilities
sudo dnf install cifs-utils -y
# Or: sudo apt install cifs-utils -y

# Create mount point
sudo mkdir -p /mnt/samba/public

# Mount share temporarily
sudo mount -t cifs //LINUXSERVER/public /mnt/samba/public -o username=smbuser1,password=Pass123

# Mount with credentials file (more secure)
sudo tee /root/.smbcredentials << 'EOF'
username=smbuser1
password=Pass123
domain=WORKGROUP
EOF
sudo chmod 600 /root/.smbcredentials

sudo mount -t cifs //LINUXSERVER/public /mnt/samba/public -o credentials=/root/.smbcredentials

# Verify mount
df -h | grep samba
# Shows mounted Samba shares

# List files on mounted share
ls -la /mnt/samba/public/

# Unmount share
sudo umount /mnt/samba/public

# Add to /etc/fstab
sudo tee -a /etc/fstab << 'EOF'
//LINUXSERVER/public /mnt/samba/public cifs credentials=/root/.smbcredentials,uid=1000,gid=1000,iocharset=utf8 0 0
//LINUXSERVER/team /mnt/samba/team cifs credentials=/root/.smbcredentials,uid=1000,gid=1000,file_mode=0664,dir_mode=2775 0 0
EOF

# Test fstab entry without rebooting
sudo mount -a
# Mounts all entries in fstab

# Verify mounts
mount | grep cifs
# Shows CIFS mounted filesystems

# Check mount options
cat /proc/mounts | grep cifs
# Displays active mount options

# Enable auto-mounting with systemd
sudo systemctl daemon-reload
sudo systemctl restart remote-fs.target

# Create systemd mount unit (alternative method)
sudo tee /etc/systemd/system/mnt-samba-public.mount << 'EOF'
[Unit]
Description=Samba Public Share
After=network-online.target
Wants=network-online.target

[Mount]
What=//LINUXSERVER/public
Where=/mnt/samba/public
Type=cifs
Options=credentials=/root/.smbcredentials,uid=1000,gid=1000

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable mnt-samba-public.mount
sudo systemctl start mnt-samba-public.mount

# GNOME Files (Nautilus) - Connect to Server
# Use GUI or CLI to open:
nautilus smb://LINUXSERVER/public

# KDE Dolphin
dolphin smb://LINUXSERVER/public

# Access via command line with gio
gio mount smb://LINUXSERVER/public
# Prompts for credentials

# List mounted remote locations
gio mount -l
# Shows all mounted remote filesystems

# Unmount remote share
gio mount -u smb://LINUXSERVER/public

# Use gvfs-mount (older GNOME)
gvfs-mount smb://LINUXSERVER/public

# Install required packages
sudo dnf install samba-winbind samba-winbind-clients krb5-workstation -y

# Configure Kerberos for domain
sudo tee /etc/krb5.conf << 'EOF'
[libdefaults]
    default_realm = DOMAIN.LOCAL
    dns_lookup_realm = true
    dns_lookup_kdc = true
    ticket_lifetime = 24h
    renew_lifetime = 7d
    forwardable = true

[realms]
    DOMAIN.LOCAL = {
        kdc = dc01.domain.local
        admin_server = dc01.domain.local
    }

[domain_realm]
    .domain.local = DOMAIN.LOCAL
    domain.local = DOMAIN.LOCAL
EOF

# Configure Samba for domain membership
sudo tee /etc/samba/smb.conf << 'EOF'
[global]
    workgroup = DOMAIN
    realm = DOMAIN.LOCAL
    security = ADS
    
    # Winbind configuration
    winbind use default domain = yes
    winbind offline logon = yes
    winbind enum users = yes
    winbind enum groups = yes
    
    # ID mapping
    idmap config * : backend = tdb
    idmap config * : range = 10000-20000
    idmap config DOMAIN : backend = rid
    idmap config DOMAIN : range = 20001-30000
    
    # Template settings
    template shell = /bin/bash
    template homedir = /home/%U
    
    # Additional settings
    kerberos method = secrets and keytab
    dedicated keytab file = /etc/krb5.keytab
EOF

# Test Kerberos configuration
sudo kinit administrator@DOMAIN.LOCAL
# Prompts for domain admin password

# Verify Kerberos ticket
sudo klist
# Shows active Kerberos tickets

# Join domain
sudo net ads join -U administrator
# Joins system to Active Directory

# Start winbind service
sudo systemctl start winbind
sudo systemctl enable winbind

# Verify domain membership
sudo net ads testjoin
# Output: Join is OK

# Test winbind functionality
sudo wbinfo -u
# Lists domain users

sudo wbinfo -g
# Lists domain groups

# Verify name resolution
sudo getent passwd administrator
# Shows domain user information

# Configure Name Service Switch
sudo tee /etc/nsswitch.conf << 'EOF'
passwd:     files winbind
shadow:     files winbind
group:      files winbind

hosts:      files dns
networks:   files

protocols:  files
services:   files
ethers:     files
rpc:        files

netgroup:   files
EOF

# Test domain user authentication
su - administrator@domain.local
# Should successfully switch to domain user

# Create home directories automatically
sudo tee -a /etc/pam.d/system-auth << 'EOF'
session required pam_mkhomedir.so skel=/etc/skel/ umask=0077
EOF

# Test home directory creation
sudo su - testuser@domain.local -c "pwd"
# Should show /home/testuser@domain.local

# Configure sudo for domain admins
sudo tee /etc/sudoers.d/domain_admins << 'EOF'
%domain\ admins ALL=(ALL) ALL
EOF
sudo chmod 440 /etc/sudoers.d/domain_admins

# Test sudo access
sudo -l -U administrator@domain.local
# Shows sudo privileges for domain admin

# Configure performance parameters
sudo tee -a /etc/samba/smb.conf << 'EOF'
[global]
    # Socket options
    socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=131072 SO_SNDBUF=131072
    
    # Use sendfile for large transfers
    use sendfile = yes
    
    # Enable asynchronous I/O
    aio read size = 16384
    aio write size = 16384
    
    # Write cache
    write cache size = 262144
    
    # Minimum receivefile size
    min receivefile size = 16384
    
    # Read-ahead size
    read raw = yes
    write raw = yes
    
    # Strict locking
    strict locking = no
    
    # Oplocks
    oplocks = yes
    level2 oplocks = yes
EOF

# Restart Samba
sudo systemctl restart smb

# Monitor performance improvements
sudo smbstatus --profile
# Shows performance statistics

# Configure filesystem mount options for Samba shares
sudo tee -a /etc/fstab << 'EOF'
/dev/sdb1 /srv/samba/data ext4 noatime,nodiratime,barrier=0 0 2
EOF

# Remount with new options
sudo mount -o remount /srv/samba/data

# Verify mount options
mount | grep /srv/samba/data
# Shows active mount options

# Enable writeback caching in share
sudo tee -a /etc/samba/smb.conf << 'EOF'
[data]
    path = /srv/samba/data
    strict sync = no
    sync always = no
EOF

# Test write performance
time dd if=/dev/zero of=/srv/samba/data/testfile bs=1M count=1000
# Measures write speed

# Clean up test file
rm /srv/samba/data/testfile

# Increase network buffers system-wide
sudo tee /etc/sysctl.d/99-samba-network.conf << 'EOF'
# Increase TCP buffer sizes
net.core.rmem_default = 262144
net.core.rmem_max = 16777216
net.core.wmem_default = 262144
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216

# Enable window scaling
net.ipv4.tcp_window_scaling = 1

# Increase connection backlog
net.core.netdev_max_backlog = 30000
EOF

# Apply sysctl changes
sudo sysctl -p /etc/sysctl.d/99-samba-network.conf

# Verify settings
sysctl net.core.rmem_max
# Output: net.core.rmem_max = 16777216

# Monitor network throughput
sudo iftop -i eth0 -f "port 445"
# Shows real-time SMB bandwidth usage

# Configure connection management
sudo tee -a /etc/samba/smb.conf << 'EOF'
[global]
    # Connection limits
    max connections = 1000
    max smbd processes = 500
    
    # Idle connection timeout
    deadtime = 15
    
    # Keepalive packets
    keepalive = 60
    
    # Maximum concurrent operations per client
    max xmit = 65535
    
    # Connection caching
    getwd cache = yes
    
    # DNS caching
    hostname lookups = no
EOF

# Monitor connection counts
watch -n 2 'sudo smbstatus | grep "^[0-9]" | wc -l'
# Shows active connection count

# Check process limits
ulimit -n
# Shows file descriptor limit

# Increase limits if needed
sudo tee -a /etc/security/limits.conf << 'EOF'
* soft nofile 65536
* hard nofile 65536
EOF

# Monitor active connections
sudo smbstatus
# Shows connected users and open files

# Continuous monitoring
watch -n 5 'sudo smbstatus --brief'
# Updates every 5 seconds

# Monitor specific share
sudo smbstatus --shares | grep "public"
# Shows connections to public share

# Show locked files
sudo smbstatus --locks
# Displays file locks

# Profile performance data
sudo smbstatus --profile
# Shows performance metrics

# Monitor user sessions
sudo smbstatus --processes
# Lists active user sessions

# Monitor main Samba log
sudo tail -f /var/log/samba/log.smbd
# Real-time log monitoring

# Search for authentication failures
sudo grep -i "authentication failure" /var/log/samba/*.log
# Shows failed login attempts

# Monitor file access
sudo tail -f /var/log/samba/log.smbd | grep -i "open"
# Shows file open operations

# Analyze connection patterns
sudo awk '/connect/ {print $1, $2, $4}' /var/log/samba/log.smbd | tail -20
# Shows recent connections

# Count connections by IP
sudo grep "connect to service" /var/log/samba/log.smbd | awk '{print $8}' | sort | uniq -c | sort -rn
# Summarizes connections by IP address

# Monitor performance issues
sudo grep -i "slow" /var/log/samba/log.smbd
# Finds performance-related log entries

# Configure comprehensive logging
sudo tee -a /etc/samba/smb.conf << 'EOF'
[global]
    # Logging parameters
    log file = /var/log/samba/log.%m
    max log size = 1000
    log level = 2 auth:3 winbind:2
    
    # Debug timestamp
    debug timestamp = yes
    debug prefix timestamp = yes
    debug pid = yes
    debug uid = yes
    
    # Per-client logging
    log file = /var/log/samba/%I.log
EOF

# Restart Samba
sudo systemctl restart smb

# Monitor specific client log
sudo tail -f /var/log/samba/192.168.1.150.log
# Shows activity from specific IP

# Rotate logs manually
sudo systemctl reload smb
# Triggers log rotation

# Configure logrotate for Samba
sudo tee /etc/logrotate.d/samba << 'EOF'
/var/log/samba/*.log {
    daily
    rotate 14
    compress
    delaycompress
    missingok
    notifempty
    create 0644 root root
    postrotate
        systemctl reload smb > /dev/null 2>&1 || true
    endscript
}
EOF

# Create monitoring script
sudo tee /usr/local/bin/samba-monitor.sh << 'EOF'
#!/bin/bash
TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
CONNECTIONS=$(smbstatus --brief | grep -c "^[0-9]")
SHARES=$(smbstatus --shares | grep -c "^[0-9]")
LOCKS=$(smbstatus --locks | grep -c "^[0-9]")

echo "$TIMESTAMP - Connections: $CONNECTIONS, Shares: $SHARES, Locks: $LOCKS" >> /var/log/samba/metrics.log
EOF

sudo chmod +x /usr/local/bin/samba-monitor.sh

# Schedule monitoring via cron
echo "*/5 * * * * /usr/local/bin/samba-monitor.sh" | sudo crontab -
# Collects metrics every 5 minutes

# View metrics
sudo tail -f /var/log/samba/metrics.log
# Shows historical metrics

# Generate daily report
sudo tail -288 /var/log/samba/metrics.log | awk '{sum+=$6} END {print "Average connections:", sum/288}'
# Calculates average connections per day

# Install SNMP daemon
sudo dnf install net-snmp net-snmp-utils -y

# Configure SNMP for Samba monitoring
sudo tee -a /etc/snmp/snmpd.conf << 'EOF'
# Samba monitoring
extend samba-connections /usr/local/bin/samba-connections.sh
extend samba-shares /usr/local/bin/samba-shares.sh
EOF

# Create SNMP extension scripts
sudo tee /usr/local/bin/samba-connections.sh << 'EOF'
#!/bin/bash
smbstatus --brief | grep -c "^[0-9]"
EOF

sudo chmod +x /usr/local/bin/samba-connections.sh

# Restart SNMP daemon
sudo systemctl restart snmpd

# Test SNMP monitoring
snmpwalk -v2c -c public localhost NET-SNMP-EXTEND-MIB::nsExtendOutput1Line
# Shows Samba metrics via SNMP

# Verify Samba users exist
sudo pdbedit -L
# Lists all Samba users

# Check specific user
sudo pdbedit -Lv username
# Shows detailed user information

# Reset user password
sudo smbpasswd username
# Prompts for new password

# Verify password backend
sudo testparm --parameter-name='passdb backend'
# Output: tdbsam (should show configured backend)

# Check authentication logs
sudo grep -i "authentication" /var/log/samba/log.smbd | tail -20
# Shows recent authentication attempts

# Test authentication directly
smbclient //localhost/share -U username
# Attempts connection with password prompt

# Verify user mapping
sudo testparm --parameter-name='username map'
# Shows username mapping configuration

# Check PAM authentication (if used)
sudo grep pam /etc/samba/smb.conf
# Shows PAM configuration

# Verify services are running
sudo systemctl status smb nmb
# Should show active (running)

# Check listening ports
sudo netstat -tulpn | grep -E 'smbd|nmbd'
# Should show processes listening

# Test local connectivity
sudo nc -zv localhost 445
# Should show connection succeeded

# Check firewall rules
sudo firewall-cmd --list-services
# Should include samba

# Test from remote client
telnet LINUXSERVER 445
# Should connect successfully

# Verify SELinux is not blocking
sudo ausearch -m avc -ts recent | grep samba
# Shows SELinux denials

# Check network connectivity
ping LINUXSERVER
# Verifies basic network connectivity

# Verify DNS resolution
nslookup LINUXSERVER
# Should resolve to correct IP

# Check Linux filesystem permissions
ls -la /srv/samba/share/
# Shows file ownership and permissions

# Verify Samba user can access directory
sudo -u smbuser1 ls /srv/samba/share/
# Tests access as Samba user

# Check SELinux contexts
ls -Z /srv/samba/share/
# Should show samba_share_t context

# Apply correct SELinux contexts
sudo restorecon -Rv /srv/samba/
# Restores default contexts

# Verify share permissions in smb.conf
sudo testparm -s | grep -A 10 "\[share\]"
# Shows share configuration

# Check ACLs
getfacl /srv/samba/share/
# Shows extended ACL permissions

# Set proper ownership
sudo chown -R smbuser1:smbusers /srv/samba/share/
sudo chmod -R 2775 /srv/samba/share/

# Test file creation
smbclient //localhost/share -U smbuser1 -c "put /tmp/testfile.txt"
# Attempts file upload

# Monitor access attempts
sudo tail -f /var/log/samba/log.smbd | grep -i "denied"
# Shows denial messages

# Check server load
top
# Shows CPU and memory usage

# Monitor disk I/O
iostat -x 2 5
# Shows disk performance metrics

# Check network saturation
iftop -i eth0
# Shows network bandwidth usage

# Verify socket options
sudo testparm --parameter-name='socket options'
# Shows configured socket options

# Test transfer speed
time smbclient //localhost/share -U username -c "get largefile.iso /dev/null"
# Measures download speed

# Check oplocks settings
sudo testparm --parameter-name='oplocks'
# Should be enabled for performance

# Monitor SMB protocol version
sudo smbstatus --protocol
# Shows negotiated protocol versions

# Verify no I/O errors
dmesg | grep -i error | tail -20
# Shows kernel error messages

# Check MTU settings
ip link show eth0 | grep mtu
# Shows network MTU size

# Verify share is configured
sudo testparm -s | grep -A 10 "\[sharename\]"
# Shows share configuration

# Check browseable setting
sudo testparm --parameter-name='browseable' --section-name=sharename
# Should show yes

# Verify nmbd is running
sudo systemctl status nmb
# Should be active

# Test share listing
smbclient -L localhost -N
# Should list all shares

# Check NetBIOS name resolution
nmblookup -S LINUXSERVER
# Shows NetBIOS information

# Verify workgroup settings
sudo testparm --parameter-name='workgroup'
# Shows configured workgroup

# Force browse list refresh
sudo nmblookup -M WORKGROUP
# Queries master browser

# Monitor browse list
sudo nmblookup -S --find-master=WORKGROUP
# Finds master browser

# Restart nmbd service
sudo systemctl restart nmb
# Refreshes NetBIOS services

# Verify network connectivity to DC
ping dc01.domain.local
# Should succeed

# Test DNS resolution
nslookup _ldap._tcp.domain.local
# Should return domain controllers

# Check Kerberos configuration
sudo kinit administrator@DOMAIN.LOCAL
# Should get Kerberos ticket

# Verify ticket obtained
sudo klist
# Shows active tickets

# Test domain connectivity
net ads info
# Shows domain information

# Check time synchronization
timedatectl status
# Time must be synchronized with DC

# Synchronize with domain time server
sudo chronyc -a 'burst 4/4'
sudo chronyc -a makestep

# Attempt domain join with verbose output
sudo net ads join -U administrator -d 10
# Shows detailed debug information

# Verify DNS entries
host -t SRV _ldap._tcp.domain.local
# Should return DC records

# Check firewall for AD ports
sudo firewall-cmd --list-ports
# Should include AD ports (88, 389, 3268)