Free LPI 300-300 Exam Dumps August 2026

In the SSSD (System Security Services Daemon) configuration file, various services can be defined to handle different types of access and authentication. The services listed in the SSSD configuration file under the [sssd] section can include:

kerberos: This service allows SSSD to handle Kerberos authentication.

nss (Name Service Switch): This service provides name resolution and manages user and group information.

sudo: This service enables SSSD to provide sudo rules based on the identity provider.

These services are specified in the services attribute of the [sssd] section of the sssd.conf file.

Example:

[sssd] services = nss, pam, sudo domains = LDAP [nss] filter_users = root filter_groups = root [sudo] sudo_provider = ldap

SSSD Services

SSSD Man Pages

Flexible Single Master Operations (FSMO) roles, also known as operations master roles, are specialized domain controller tasks in an Active Directory environment. The FSMO roles include:

C . PDC Emulator

The Primary Domain Controller (PDC) Emulator is responsible for synchronizing time and managing password changes.

D . RID Master

The Relative ID (RID) Master allocates blocks of RIDs to each domain controller in the domain.

Microsoft Docs - FSMO Roles

CN=Users Container:

GPOs: Group Policy Objects (GPOs) cannot be linked to this container because it is not an Organizational Unit (OU). GPOs can only be applied to OUs.

Default Location: New users are created in the CN=Users container by default when using standard Active Directory tools unless specified otherwise.

Other Options:

Users outside this container can log in.

The container can contain both user objects and user groups.

Users created here do not need to be moved to log in.

Active Directory Containers and OUs

The sssd.conf file is the configuration file for the System Security Services Daemon (SSSD). SSSD provides access to different identity and authentication providers. The configuration file typically contains multiple sections, but the [sssd] section is always present. This section provides global options that apply to all other sections of the file.

Example:

[sssd] config_file_version = 2 services = nss, pam domains = LDAP

SSSD Configuration

SSSD Man Pages

samba-tool drs: This set of commands is used to manage directory replication in an Active Directory domain. DRS stands for Directory Replication Service.

Functionality: It provides various subcommands to monitor, manage, and troubleshoot replication issues.

Other Commands:

samba-tool repl, directory, domain, sync: These do not specifically manage directory replication in the same way as samba-tool drs.

Samba DRS Command Documentation

Adding SSSD to /etc/nsswitch.conf:

To include SSSD (System Security Services Daemon) as a source of information in the /etc/nsswitch.conf file, the service name sss must be added. This is specified without any parameters. The sss service allows the system to retrieve information from various sources, such as LDAP, Kerberos, and others, as configured in SSSD.

SSSD documentation

nsswitch.conf configuration guidelines

The effective permissions of a file created with the permissions 777 can be calculated considering the create mask and force create mode.

create mask = 711 implies that the permission bits are ANDed with 0711, i.e., only the owner can read, write, and execute.

force create mode = 750 implies that certain permission bits are always set, specifically 0750, i.e., read, write, and execute for the owner, and read and execute for the group.

The create mask reduces the permissions to 0711, and then force create mode adds the 0750 mask to the result.

Original permission: 777 AND with create mask (711): 711 OR with force create mode (750): 751

Thus, the effective permission is 751.

Samba smb.conf man page - create mask

When browseable = no is set in the [homes] section of smb.conf, it prevents the share from appearing in the list of available shares when users browse the server. However, users can still access their home directories if they specify the correct UNC path directly.

A . When browsing the Samba server, there is no visible share named after the current user.

The share will not appear in the list of shares visible to the user during browsing.

D . The homes share can be directly accessed by specifically opening this share by its UNC path.

Users can still access the share by directly typing the path in the form \\servername\username.

Samba Official Documentation - Home Directories