Learn Samba - Core Concepts & Key Architecture

#Introduction

Now that you understand the history and reasons behind Samba from episode 1, it's time to open the hood: the architecture that lets Samba serve files, print, and domain authentication all at once. Instead of a single monolith, Samba consists of several daemons and tools, each handling one specific task. Understanding this division of labor is the key to making the upcoming episodes (especially AD and winbind) feel easy.

#Architecture: The Samba Daemons

#smbd: The Heart of File & Print Sharing

smbd is the main daemon. It listens for SMB connections on port 445 (and 139 via NetBIOS), serves file open/read/write requests, manages locking, and handles printer shares. Each client connection is handled by an smbd process spawned from the master process. In short: file and print are smbd's job.

ps aux | grep smbd | grep -v grep

#nmbd: NetBIOS Name Service

nmbd manages the NetBIOS name service — an old naming system that lets hosts be found by NetBIOS name (rather than DNS) on a local network, using ports 137/138 and broadcast. In modern times, NetBIOS is increasingly abandoned in favor of DNS, but this daemon is still needed for network discovery by legacy Windows clients and some shares accessed via \\netbiosname\share. With server min protocol = SMB2 (episode 14), nmbd's role shrinks, but keeping it running is never wrong.

#winbindd: The Bridge to Active Directory

winbindd resolves users and groups from an Active Directory domain and maps them to local Linux UIDs/GIDs. Without winbind, AD users won't appear as Unix identities usable by chown, ls, or PAM for login. We dissect this in depth in episode 10 — for now, just remember the division: smbd = files, nmbd = NetBIOS names, winbindd = AD identities.

#Protocols: SMB 1, 2, and 3

#Dialects That Once Divided

SMB isn't a single protocol — it's a family of dialects that evolved over three decades:

• SMB1 (1980s-1990s): the original dialect, fragile security-wise. Devastating attacks like WannaCry and EternalBlue (2017) exploited its vulnerabilities.
• SMB2 (Vista/2008): a major overhaul — reduced chatter, improved performance, and closed many SMB1 holes.
• SMB3 (2012+): the modern era — brings encryption, stronger signing, advanced oplocks, and multichannel support. This is the default on Samba and modern Windows.

#Modern Default: SMB3, SMB1 Disabled

Since Samba 4.11 (2019), SMB1 support is disabled by default. This means without extra configuration, Samba won't serve clients that only speak SMB1 — and that's the right decision for security. The default dialects are set via server min protocol and server max protocol:

[global]
   server min protocol = SMB2_10
   server max protocol = SMB3_11

server max protocol = SMB3_11 means Samba uses the latest SMB3 capabilities. We cover the full hardening settings in episodes 8 and 14.

#Core Samba Components

#smb.conf: One File for Everything

All Samba configuration lives in /etc/samba/smb.conf — an INI format with a [global] section and per-share sections. This file is re-read periodically by the daemons (you can force it with smbcontrol all reload-config). This is where you'll be working in nearly every episode.

#Command-Line Tools

Samba provides a complete toolset for administration:

smbclient --version
samba-tool --version
smbpasswd --version 2>/dev/null || echo "smbpasswd tersedia setelah install"
testparm --version

Here's the division of labor:

• smbclient: command-line client — browsing, accessing, and testing shares (episode 6).
• samba-tool: the Swiss Army knife for domains — provision AD DC, manage users, DNS, replication (episode 9+).
• smbpasswd: manages Samba user passwords (episode 5).
• testparm: validates smb.conf syntax — must be run after every edit (episode 3).

Complete the set with pdbedit (password database), smbstatus (view active connections), and net (join domain / manage shares).

#Mapping Jobs to Daemons

For easy recall, here's how the work is divided:

• File/print sharing → smbd (SMB on ports 445/139).
• NetBIOS name & discovery → nmbd (ports 137/138).
• AD user/group resolution → winbindd (SID → UID/GID mapping).
• Domain Controller mode → the samba daemon replaces the work of smbd + nmbd + AD DNS (episode 9).

#Closing

Key takeaways:

• smbd serves file/print, nmbd serves NetBIOS, winbindd serves AD identities.
• SMB1/2/3 are three protocol eras; SMB3 is the default and SMB1 has been disabled since Samba 4.11.
• server min protocol/server max protocol control which dialects are served.
• smb.conf is the configuration center; smbclient, samba-tool, smbpasswd, and testparm are the core tools.
• Domain Controller mode uses the single samba daemon, not separate smbd/nmbd.

In episode 3 next, we'll do the first install: install the samba package, enable the smbd/nmbd services, write the basic [global] and [share] configuration, and validate everything with testparm. Your environment from episode 0 will finally start to work!