NCAE Mapping Hub
Overview Scoreboard Data Roles Exercised Checklists Lessons Skill Drills Practice Terminal Progress
SMB Login failure 3x weight measured

SMB Login refused (Errno 111). Samba not accepting connections

SMB operation failed: [Errno 111] Connection refused
Events
3,184
Pts per check
4.2
Pts missed
13,266.7
Teams hit
13/13

Authority mappings

Which work roles, knowledge units, and EWU courses this error pattern touches. Hover for context, click to drill in.

DCWF roles: CE-463 Host Analyst CS-462 Control Systems Security Specialist CS-521 Cyber Defense Infrastructure Support Specialist CS-531 Cyber Defense Incident Responder IT-411 Technical Support Specialist IT-451 System Administrator
Knowledge Units: CD-ISC IT Systems Components CD-NDF Network Defense CD-OSA Operating Systems Administration CD-OSC Operating Systems Concepts CD-OSH Operating Systems Hardening
EWU courses: CSCD240-S26 CSCD210 CSCD212 CSCD240 CSCD327 CSCD379 CSCD380 CSCD381 CSCD434 CSCD470 CSCD496

What the message means

Errno 111 is POSIX for 'Connection refused'. The scoring engine reached port 445 on your server but nothing is listening (or the listener closed the connection immediately). Either **smbd is not running**, or **port 445 isn't forwarded through the MikroTik router**. SMB Login is the **single highest-value service at 3× weight** (4.17 pts/check). Fix this before anything else.

Why the service is down

Commands in order

  1. 1. 1. Is smbd running?
    systemctl status smbd
    Expect
    active (running)
    Interpret and next
    If inactive: `systemctl start smbd`. If it fails: `journalctl -u smbd -n 50`.
  2. 2. 2. Listening on 445?
    ss -tlnp | grep :445
    Expect
    smbd on 0.0.0.0:445 or :::445
    Interpret and next
    If only 127.0.0.1: fix smb.conf `interfaces` and `bind interfaces only`, then restart smbd.
  3. 3. 3. Validate smb.conf
    testparm -s 2>&1 | head -30
    Expect
    Parses cleanly; `[files]` share present; `security = user`
    Interpret and next
    Error lines indicate the bad directive. Diff against backup: `diff /etc/samba/smb.conf /root/smb.conf.backup`.
  4. 4. 4. Verify Samba users exist
    pdbedit -L
    Expect
    At least the expected users: keons, henri_cartan, listo, nills, reisdro, lisdn
    Interpret and next
    Missing: `smbpasswd -a <user>` and re-enter password.
  5. 5. 5. Try a local connection as the scoring user
    smbclient -L //localhost -U keons
    Expect
    Lists shares (incl. `files`) without error
    Interpret and next
    ACCESS DENIED = password wrong. NT_STATUS_CONNECTION_REFUSED = service still down.
  6. 6. 6. Router NAT
    /ip firewall nat print where dst-port=445
    Expect
    dstnat TCP 445 -> <server-IP>:445
    Interpret and next
    Missing? Add it with `/ip firewall nat add chain=dstnat protocol=tcp dst-port=445 action=dst-nat to-addresses=<ip> to-ports=445`
  7. 7. 7. Nuclear restore
    cp /root/competition-backups/smb.conf /etc/samba/smb.conf ; systemctl restart smbd
    Expect
    Back to known-good config
    Interpret and next
    Use when the student has edited smb.conf beyond repair.

Decision tree

Answer each question to route to the right fix.

Q: Is smbd active per systemctl?
Yes:
Q: Listening on 445 on 0.0.0.0?
Yes:
Q: smbclient -L //localhost -U keons works?
Yes: Router NAT is the problem. Add /ip firewall nat for 445.
No: Samba users missing or wrong password. smbpasswd -a.
No: Fix interfaces binding in smb.conf.
No: Start it. Read journalctl if it won't start (usually smb.conf syntax).

External references

Other patterns on this service