Day 5 - Week 11 Comprehensive Review: The Big Picture of Sharing, Firewalls, and Security

📌 Key Points

• This week's axis is connection (sharing) and defense (security) — you have to open things up for them to be useful, but the more is open, the greater the risk.
• Sharing: when Windows is mixed in, use Samba (smbd 139/445, nmbd 137/138, smb.conf); when everything is Linux, use NFS (rpcbind 111, /etc/exports).
• Firewalls: iptables works as table→chain (INPUT/OUTPUT/FORWARD)→rule, and firewalld works per zone. The way changes are applied and persisted differs.
• Access control: TCP Wrapper is allow first, and SELinux is MAC on top of DAC (3 modes + the type context).
• The top 3 traps: the space before the parenthesis in exports, --reload after --permanent in firewalld, and no disabled with setenforce.

Day 1 Review: Samba — The Bridge to Windows

• Samba implements Windows' SMB/CIFS protocol on Linux, enabling file and printer sharing between heterogeneous operating systems.
• Two daemons are the core.

• Configuration is done through the section structure of /etc/samba/smb.conf.
• Special sections: [global] (global), [homes] (automatic home sharing), [printers] (automatic printer sharing). Every other section name becomes a share name.
• Share directives: path, writable (= read only no), valid users (@ for groups), guest ok.
• Samba accounts are created with smbpasswd -a, separately from Linux accounts. A Linux system account must exist first.
• Validation is testparm, and the connection test is smbclient -L.

💡 One-line summary: Samba is a double permission gate — you must pass both the Samba permissions in smb.conf and the Linux filesystem permissions to get access.

Day 2 Review: NFS — The Unix Standard Sharing

• NFS is RPC-based, so the port mapper rpcbind (port 111) must be alive.
• Server configuration is the single /etc/exports file, in the format "directory client(options)".

/srv/share    192.168.1.0/24(rw,sync,no_subtree_check)

• Here, no space between the client and the parenthesis is the biggest trap (with a space, those options are opened to *).
• Main options: ro/rw, sync/async, root_squash (default, secure)/no_root_squash (dangerous).
• Apply after editing with exportfs -ra.
• The client checks with showmount -e and attaches with mount -t nfs server:path mount_point.

Selection in one line: if everything is Linux, use NFS; if Windows is mixed in, use Samba.

Day 3 Review: Firewalls — iptables and firewalld

• iptables controls the kernel's netfilter and has a table→chain→rule structure.
• Memorize the three chains of the filter table by direction — INPUT (incoming), OUTPUT (outgoing), FORWARD (passing through).
• Rules are matched in order from top to bottom, and if none match, the default policy (-P) applies.

• firewalld groups trust levels into zones (drop/block/public/home/trusted) and is managed with firewall-cmd.
• The biggest trap is runtime vs --permanent — after changing with permanent, you must --reload for it to apply now.

⚠️ Common trap: iptables rules exist only in memory, so you must save them with service iptables save for them to persist after a reboot. Also, if you do not add the SSH allow rule before -P INPUT DROP when working remotely, you cut yourself off.

Day 4 Review: Access Control and Logs

• TCP Wrapper : the order is hosts.allow (first) → hosts.deny → default allow. The service : host syntax uses the keywords ALL/LOCAL/EXCEPT.
• SELinux : MAC on top of DAC. You handle the three modes enforcing/permissive/disabled with getenforce/setenforce, but you cannot reach disabled with setenforce, and permanent changes go in /etc/selinux/config.
• SELinux context : in user:role:type:level, the type is the key. View it with ls -Z, change it with chcon, and restore it with restorecon.
• Log files : messages, secure, maillog, and cron in /var/log. The binary wtmp/btmp/lastlog are read with the dedicated commands last/lastb/lastlog.
• rsyslog.conf : the facility.priority pair records the specified level and above. .none excludes, and = means only that level.
• logrotate : rotates and retains logs with rotate N, compress, and daily/weekly.

Security debugging signal: "the permissions are right but access fails" → suspect the SELinux context. If it goes away with setenforce 0, it is an SELinux problem (in production, do not turn it off; fix the context).

Key Comparisons That Are Easy to Mix Up, at a Glance

We wrap up the week with the comprehensive questions below.

📖 Glossary

• SMB/CIFS : Windows' file sharing protocol. Samba implements it on Linux.
• smbd / nmbd : Samba's sharing/authentication daemon (TCP 139/445) / NetBIOS name resolution daemon (UDP 137/138).
• rpcbind : The port mapper (111) that tells the ports of RPC services. A prerequisite for NFS to work.
• /etc/exports : The file where the NFS server writes "which directory to export to whom with what permissions".
• root_squash : The default security option in NFS that demotes the client's root to an anonymous user.
• chain : A bundle of rules per packet direction in iptables. There are three: INPUT, OUTPUT, FORWARD.
• DROP / REJECT : Blocking by silently discarding with no response / blocking by sending a rejection response.
• zone : A rule set that firewalld groups by trust level. public is the default.
• --permanent : The option that keeps a firewalld setting after reboot. To apply it immediately, --reload is needed.
• hosts.allow / hosts.deny : TCP Wrapper's allow and deny lists. allow is checked first.
• MAC (mandatory access control) : Access control where the kernel enforces a policy that even root cannot escape. SELinux falls under this.
• facility.priority : The pair in rsyslog that specifies a log's source and severity. The specified level and above are recorded.

📝 Practice Questions

Click a choice to reveal the answer and explanation.

Question 1

In Samba, which is the correct daemon and port for NetBIOS name resolution and network browsing?

• Asmbd, TCP 445
• Bnmbd, UDP 137/138
• Crpcbind, TCP 111
• Dsmbd, UDP 137/138

Question 2

Among the following /etc/exports entries, which is the wrong setting that opens rw permission to all hosts against the intent?

• A/data 192.168.1.0/24(rw,sync)
• B/data 192.168.1.10(rw)
• C/data 192.168.1.10 (rw)
• D/data *(ro)

Question 3

Which is the correct iptables command to allow incoming TCP connections on port 80 (HTTP) from outside?

• Aiptables -A OUTPUT -p tcp --sport 80 -j ACCEPT
• Biptables -A INPUT -p tcp --dport 80 -j ACCEPT
• Ciptables -P INPUT -p udp --dport 80 -j DROP
• Diptables -A FORWARD -p tcp --dport 80 -j REJECT

Question 4

In firewalld, how do you allow the http service so that it persists after a reboot and also apply it immediately?

• ARun only firewall-cmd --add-service=http
• BRun only firewall-cmd --add-service=http --permanent
• CRun firewall-cmd --add-service=http --permanent, then firewall-cmd --reload
• Dfirewall-cmd --remove-service=http --reload

Question 5

In TCP Wrapper, what happens to a host that matches neither hosts.allow nor hosts.deny?

• AIt is denied
• BIt is allowed
• CAn error occurs
• Dhosts.deny takes priority and it is denied

Question 6

What is the correct way to permanently change SELinux to disabled?

• ARun setenforce 0
• BRun getenforce disabled
• CEdit /etc/selinux/config to SELINUX=disabled and reboot
• DRun setsebool disabled on

Question 7

Which of the following correctly describes the authpriv.* /var/log/secure setting in rsyslog.conf?

• AIt records messages of all priorities of the authpriv facility in /var/log/secure
• BIt records authpriv messages of all facilities
• CIt excludes authpriv from the log
• DIt records only error level and above

Question 8

Which correctly pairs the filesystem types used to mount an NFS share and a Samba share on a Linux client?

• ANFS: cifs, Samba: nfs
• BNFS: nfs, Samba: cifs
• CNFS: smbfs, Samba: nfs
• DNFS: ext4, Samba: cifs

Question 9

In iptables, when an "everything DROP" rule is already near the top of the chain, which option must you use to effectively add a specific port allowance?

• AAppend to the end with -A (Append)
• BInsert in front of the DROP rule with -I (Insert)
• CDelete with -D (Delete)
• DChange the policy with -P (Policy)

Question 10

Which correctly pairs the command that views failed login records with its target file?

• Alast — /var/log/btmp
• Blastb — /var/log/btmp
• Clastlog — /var/log/wtmp
• Dlastb — /var/log/wtmp

Question 11

When NFS does not work, which service and port should you check first?

• Asmbd, 445
• Brpcbind, 111
• Cnamed, 53
• Dhttpd, 80

Question 12

Which correctly describes the behavior of the logrotate settings weekly + rotate 4 + compress?

• AIt rotates daily and keeps 4 without compression
• BIt rotates weekly, keeps the most recent 4 (about 4 weeks' worth) compressed, and deletes the excess
• CIt rotates when 4 MB is exceeded
• DIt rotates once every 4 weeks