File sharing with NFS and Samba
Sharing and access control on Linux and Windows networks.
Level 201 · 18 lessons · 15 practice labs
Lessons
NFS
- An NFS server and exports: You learn to share a folder from Linux to other machines over NFS and what the export settings do.
- An NFS client and mounting: You learn to attach an NFS share from another machine to your own system and make the mount permanent.
- NFS export options and access control: You learn to limit who can reach an NFS share with export options and to close permissions that are wider than needed.
- Mounting on demand with autofs
- NFSv4 identity mapping and user IDs
- Short task: serve home directories to clients over NFS
Samba
- Installing Samba: smbd and nmbd: You will install Samba, which shares files with Windows, and understand what the smbd and nmbd services are for.
- A Samba public share and smbclient: You will see how a public share without a password is set up, check it with smbclient, and understand when it is risky.
- Samba users and authentication: You learn to create Samba users, authenticate them with a password, and limit access to a share person by person.
- Shares per group: valid users and write access
- Mounting a Samba share from Linux with cifs-utils
- Watching access with smbstatus and audit logs
- Short task: separate Samba shares for three departments
Permissions and operations
- Aligning NFS and Samba share and file permissions: You learn how share permissions and file system permissions work together and how to keep the two consistent.
- Backing up shares and restoring earlier versions
- Share problems: permission denied, stale handles, locks
- Short task: find out why a user cannot open a folder
Wrap-up
- Capstone: a file server for a mixed environment with NFS and Samba: In a fictional company you set up a small file server that serves both Linux and Windows users with the right permissions.
Practice labs
- Share the archive folder read-only: Export a folder over NFS read-only to the given subnet only, and show that writing is refused on the client.
- Even root can’t write on the client: Investigate a share that can’t be written because of root_squash and file ownership, then give the right user write access without weakening security, and test it.
- Files show up under someone else’s name: Find the UID/GID mismatch and the NFSv4 idmap domain error between client and server, fix them and show the files appear with the correct owner.
- Mount the share at every boot: Add the NFS share to fstab with options that wait for the network, and show with mount -a that it mounts without errors.
- Project folders on demand: Use autofs so each project folder mounts on first access and unmounts when idle, and show it in the mount output.
- Stale file handle: the export was moved: Clear the stale file handle errors clients get after the server’s export was moved, explain the cause and set the permanent mount up again.
- Everyone reads, staff write: Create a Samba share everyone can read but only the staff group can write to, and show both cases with smbclient.
- A user can’t log in to Samba: Find why a user with a Linux account can’t log in to Samba (smbpasswd entry, valid users, disabled account) and prove the login with smbclient.
- Sales can see the accounting files: Fix the shares that the wrong department can reach because of group and valid users mistakes, and test that each department’s user reaches only their own share.
- Mount without putting the password in fstab: Mount the Samba share on Linux using a credentials file with 600 permissions, and show there is no password in the fstab line.
- Who locked the file?: Use smbstatus to find the user and machine holding a spreadsheet open, and show that the file opens after their session is closed.
- Trace a deleted folder: Enable the full_audit module, reproduce a deletion and extract from the log which user deleted which file and when.
- Permission denied: the folder permission: Find the file-system permission that stops a user opening a shared folder, give the group the right permission and show access as that user.
- New files are created with the wrong group: Fix files in a shared folder that others can’t edit by using setgid and create-mask settings, and test from both NFS and Samba.
- An overwritten report: bring back yesterday’s version: Find yesterday’s version of an overwritten file in the share’s snapshots, restore it to the user’s share and show the backups run on a schedule.
About this course
Sharing and access control on Linux and Windows networks.
What you will learn
- NFS
- Samba
- Permissions and operations
- Wrap-up
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.