Samba服务实践

[root@samba ~]# yum install samba -y

[root@samba ~]# systemctl start smb && systemctl enable smb

[root@samba ~]# netstat -lntp|grep smb

tcp        0      0 0.0.0.0:139             0.0.0.0:*               LISTEN      1739/smbd           

tcp        0      0 0.0.0.0:445             0.0.0.0:*               LISTEN      1739/smbd           

tcp6       0      0 :::139                  :::*                    LISTEN      1739/smbd           

tcp6       0      0 :::445                  :::*                    LISTEN      1739/smbd 

[root@samba ~]# testparm   #检测配置文件语法

[root@samba ~]# egrep -v '^#|^$' /etc/samba/smb.conf

[global]           #全局设置

	workgroup = SAMBA

	security = user

	passdb backend = tdbsam

	printing = cups

	printcap name = cups

	load printers = yes

	cups options = raw

[homes]            #用户目录共享设置

	comment = Home Directories

	valid users = %S, %D%w%S

	browseable = No

	read only = No

	inherit acls = Yes

[printers]         #打印机共享设置

	comment = All Printers

	path = /var/tmp

	printable = Yes

	create mask = 0600

	browseable = No

[print$]           #自定义名称的共享目录设置

	comment = Printer Drivers

	path = /var/lib/samba/drivers

	write list = @printadmin root

	force group = @printadmin

	create mask = 0664

	directory mask = 0775

workgroup = WORKGROUP

#设定 Samba Server 所要加入的工作组或者域

server string = Samba Server Version %v

#设定 Samba Server 的注释，可以是任何字符串，也可以不填。宏 % v 表示显示 Samba 的版本号

hosts allow = 127. 192.168.1. 192.168.10.1

#表示允许连接到 Samba Server 的客户端，多个参数以空格隔开。可以用一个 IP 表示，也可以用一个网段表示。hosts deny 与 hosts allow 刚好相反。

#例如：hosts allow=172.17.2.EXCEPT172.17.2.50

#表示容许来自 172.17.2.* 的主机连接，但排除 172.17.2.50

#hosts allow=172.17.2.0/255.255.0.0

#表示容许来自 172.17.2.0/255.255.0.0 子网中的所有主机连接

log file = /var/log/samba/log.%m

#设置 Samba Server 日志文件的存储位置以及日志文件名称。在文件名后加个宏 % m（主机名），表示对每台访问 Samba Server 的机器都单独记录一个日志文件。如果 pc1、pc2 访问过 Samba Server，就会在 /var/log/samba 目录下留下 log.pc1 和 log.pc2 两个日志文件。

passdb backend = tdbsam

#passdb backend 就是用户后台的意思。目前有三种后台：smbpasswd、tdbsam 和 ldapsam。sam 应该是 security account manager（安全账户管理）的简写。

security = user

#说明：设置用户访问 Samba Server 的验证方式，一共有四种验证方式。

#1.share：用户访问 Samba Server 不需要提供用户名和口令，安全性能较低。

#2.user：Samba Server 共享目录只能被授权的用户访问，由 Samba Server 负责检查账号和密码的正确性。账号和密码要在本 Samba Server 中建立。

#3.server：依靠其他 Windows NT/2000 或 Samba Server 来验证用户的账号和密码，是一种代理验证。此种安全模式下，系统管理员可以把所有的 Windows 用户和口令集中到一个 NT 系统上，使用 Windows NT 进行 Samba 认证，远程服务器可以自动认证全部用户和口令，如果认证失败，Samba 将使用用户级安全模式作为替代的方式。

#4.domain：域安全级别，使用主域控制器 (PDC) 来完成认证。

max connections = 0

#max connections 用来指定连接 Samba Server 的最大连接数目。如果超出连接数目，则新的连接请求将被拒绝。0 表示不限制。

load printers = yes/no

#设置是否在启动 Samba 时就共享打印机。

printcap name = cups

#设置共享打印机的配置文件

printing = cups

#设置 Samba 共享打印机的类型。现在支持的打印系统有：bsd, sysv, plp, lprng, aix, hpux, qnx

[共享名]

comment = 任意字符串

#comment 是对该共享的描述，可以是任意字符串

path = 共享目录路径

#path 用来指定共享目录的路径

guest ok = yes/no

#允许任何人访问，等同于同 “public”

read only = yes	

#所有人只读

writable = yes/no

#writable 用来指定该共享路径是否可写

write list = 允许写入该共享的用户

#write list 用来指定可以在该共享下写入文件的用户。

#例如：write list = bobyuan，@bob

browseable = yes/no

#browseable 用来指定该共享是否可以浏览

valid users = 允许访问该共享的用户

#valid users 用来指定允许访问该共享资源的用户

#例如：valid users = bobyuan，@bob，@tech（多个用户或者组中间用逗号隔开，如果要加入一个组就用 “@+ 组名” 表示。）

#1. 修改配置文件

[root@samba ~]# egrep -v '^#|^$' /etc/samba/smb.conf

[global]

	workgroup = workgroup

	security = User

    map to guest = Bad User  #目前 "security = share" 参数已被弃用，取而代之的是 map to guest = Bad User

	passdb backend = tdbsam

	printing = cups

	printcap name = cups

	load printers = yes

	cups options = raw

[homes]

	comment = Home Directories

	valid users = %S, %D%w%S

	browseable = No

	read only = No

	inherit acls = Yes

[printers]

	comment = All Printers

	path = /var/tmp

	printable = Yes

	create mask = 0600

	browseable = No

[print$]

	comment = Printer Drivers

	path = /var/lib/samba/drivers

	write list = @printadmin root

	force group = @printadmin

	create mask = 0664

	directory mask = 0775

[Public Share]                      #共享名称      

	comment = This is public share  #所有人可写

	path = /data                    #共享目录

	browseable = yes                #共享是否可以见

	writable = yes                  #所有人可写

	guest ok = yes                  #所有人可访问

#2. 重启 smbf 服务

[root@samba ~]# testparm

[root@samba ~]# systemctl restart smb

#3. 修改系统权限

[root@samba ~]# mkdir /data

[root@samba ~]# ll -d /data/

drwxr-xr-x. 5 root root 49 Jun 23 14:26 /data/

#share 访问全部映射成 nobody 用户访问，nobody 没有权限访问 data 目录，需要添加系统权限

[root@samba ~]# chown nobody /data

[root@samba ~]# ll -d /data

drwxr-xr-x. 5 nobody root 73 Jun 25 14:22 /data

[root@qnyp-client1 ~]# yum install samba-client -y

[root@samba-client ~]# smbclient -L //192.168.1.50 -U 用户名          #查看共享资源

[root@samba-client ~]# smbclient //192.168.1.50 / 共享名 -U 用户名       #访问共享资源

[root@samba-client ~]# ls           #查看

[root@samba-client ~]# get          #下载

[root@samba-client ~]# push         #上传

#1. 修改配置文件

[root@samba ~]# egrep -v '^#|^$' /etc/samba/smb.conf

[global]

	workgroup = SAMBA

	security = user   #user 级别访问 

	passdb backend = tdbsam

	printing = cups

	printcap name = cups

	load printers = yes

	cups options = raw

[homes]

	comment = Home Directories

	valid users = %S, %D%w%S

	browseable = No

	read only = No

	inherit acls = Yes

[printers]

	comment = All Printers

	path = /var/tmp

	printable = Yes

	create mask = 0600

	browseable = No

[print$]

	comment = Printer Drivers

	path = /var/lib/samba/drivers

	write list = @printadmin root

	force group = @printadmin

	create mask = 0664

	directory mask = 0775

[cawu_share]                     

	comment = This is caiwu share 

	path = /public         #共享目录           

	browseable = yes       #共享是否可以见       

	writable = yes         #所有人可写      

    write list = yangxiao    #允许写入该共享的用户

    valid users = yangxiao   #允许访问该共享的用户

[root@samba ~]# systemctl restart smb

#2. 添加 samba 密码，该用户必须已经是系统用户

[root@samba ~]# mkdir /public

[root@samba ~]# useradd -s /sbin/nologin yangxiao

[root@samba ~]# smbpasswd -a yangxiao               

[root@samba ~]# testparm            #测试语法

[root@samba ~]# ll -d /public/

drwxr-xr-x 2 root root 6 Jun 25 20:25 /public/

#3. 添加 publi 目录系统用户权限	

[root@samba ~]# chown yangxiao.yangxiao /public/         

[root@samba ~]# ll /public/ -d

drwxr-xr-x 2 yangxiao yangxiao 55 Jun 25 20:44 /public/

#1. 修改配置文件

[root@samba ~]# egrep -v '^#|^$' /etc/samba/smb.conf

[global]

	workgroup = SAMBA

	security = user

	passdb backend = tdbsam

	printing = cups

	printcap name = cups

	load printers = yes

	cups options = raw

[homes]

	comment = Home Directories

	valid users = %S, %D%w%S

	browseable = No

	read only = No

	inherit acls = Yes

[printers]

	comment = All Printers

	path = /var/tmp

	printable = Yes

	create mask = 0600

	browseable = No

[print$]

	comment = Printer Drivers

	path = /var/lib/samba/drivers

	write list = @printadmin root

	force group = @printadmin

	create mask = 0664

	directory mask = 0775

[cawu_share]                     

	comment = This is caiwu share 

	path = /public           #共享目录  

	browseable = yes         #共享是否可以见    

	writable = yes           #所有人可写  

;   write list = yangxiao  #允许写入该共享的用户

;   valid users = yangxiao #允许访问该共享的用户

#2. 添加用户并授予系统权限

[root@samba ~]# useradd -s /sbin/nologin weiyixiao

[root@samba ~]# smbpasswd -a weiyixiao            #要给用户添加 samba 密码，该用户必须已经是系统用户

[root@samba ~]# ll /public/ -d

drwxr-xr-x 2 yangxiao yangxiao 55 Jun 25 20:44 /public/

[root@samba ~]# chmod 775 /public

[root@samba ~]# usermod -a -G yangxiao weiyixiao    #将 weiyixiao 用户添加到 yangxiao 组

[root@samba ~]# systemctl start smb

#1. 添加系统用户

[root@manager ~]# useradd -s /sbin/nologin test 

#2. 添加 samba 密码，该用户必须已经是系统用户

[root@manager ~]# smbpasswd -a test     

#3. 查看 smb 用户

[root@samba ~]# pdbedit -L

yangxiao:1003:

test:1005:

weiyixiao:1004:

#4. 删除 smb 用户

[root@samba ~]# smbpasswd -x test

Deleted user test.

[root@samba ~]# pdbedit -L

yangxiao:1003:

weiyixiao:1004:

#5.samba Linux 客户端访问

[root@manager ~]# smbclient //192.168.40.188/public -U xuyong   #public 共享名

[root@samba ~]# yum install samba -y

[root@Harbor public_share]# egrep -v '^#|^$' /etc/samba/smb.conf

[global]

	workgroup = SAMBA

	security = user

	passdb backend = tdbsam

	printing = cups

	printcap name = cups

	load printers = yes

	cups options = raw

[homes]

	comment = Home Directories

	valid users = %S, %D%w%S

	browseable = No

	read only = No

	inherit acls = Yes

[printers]

	comment = All Printers

	path = /var/tmp

	printable = Yes

	create mask = 0600

	browseable = No

[print$]

	comment = Printer Drivers

	path = /var/lib/samba/drivers

	write list = @printadmin root

	force group = @printadmin

	create mask = 0664

	directory mask = 0775

[public_share]                          

	comment = This is public share  

	path = /samba_share/public_share

	browseable = yes              

	writable = yes               

[yewu_share]

        comment = This is caiwu share

        path = /samba_share/yewu_share

        browseable = yes

        writable = yes

[caiwu_share]

        comment = This is yewu share

        path = /samba_share/caiwu_share

        browseable = yes

        writable = yes

[root@samba ~]# systemctl restart smb

[root@samba ~]# mkdir /samba_share/

[root@samba ~]# cd /samba_share/

[root@samba samba_share]# mkdir caiwu_share

[root@samba samba_share]# mkdir yewu_share

[root@samba samba_share]# public_share

[root@samba ~]# ll -d /samba_share/yewu_share

drwxr-xr-x 2 root root 6 Jun 26 11:27 /samba_share/yewu_share

[root@samba ~]# ll -d /samba_share/caiwu_share/

drwxr-xr-x 2 root root 6 Jun 26 11:26 /samba_share/caiwu_share

[root@samba ~]# ll -d /samba_share/public_share/

drwxr-xr-x 2 root root 6 Jun 26 11:27 /samba_share/public_share

#1. 添加系统用户

[root@samba ~]# useradd -s /sbin/nologin wangyuyan

[root@samba ~]# useradd -s /sbin/nologin azhu

[root@samba ~]# useradd -s /sbin/nologin duanyu

[root@samba ~]# useradd -s /sbin/nologin xuzhu

[root@samba ~]# useradd -s /sbin/nologin qiaofeng

#2. 添加 smb 密码

[root@samba ~]# smbpasswd -a wangyuyan

[root@samba ~]# smbpasswd -a azhu

[root@samba ~]# smbpasswd -a duanyu

[root@samba ~]# smbpasswd -a xuzhu

[root@samba ~]# smbpasswd -a qiaofeng

#3. 查看 smb 用户

[root@samba ~]# pdbedit -L

wangyuyan:1002:

duanyu:1004:

qiaofeng:1006:

azhu:1003:

xuzhu:1005:

#1. 修改目录权限

[root@samba ~]# chmod 700 /samba_share/public_share

#2. 为用户添加 ACL 权限

#添加 ACL 权限

[root@samba ~]# setfacl -m u:qiaofeng:rx /samba_share/public_share

#3. 查看 ACL 权限

[root@samba ~]# getfacl /samba_share/public_share

getfacl: Removing leading '/' from absolute path names

# file: samba_share/public_share

# owner: root

# group: root

user::rwx

user:qiaofeng:r-x

group::---

mask::r-x

other::---

#4. 删除 ACL 权限

[root@samba ~]# setfacl -x u:qiaofeng /samba_share/public_share

#1. 新建组并加入用户

[root@samba ~]# groupadd caiwu

[root@samba ~]# groupadd yewu

[root@samba ~]# usermod -a -G caiwu wangyuyan

[root@samba ~]# usermod -a -G caiwu azhu

[root@samba ~]# usermod -a -G yewu duanyu

[root@samba ~]# usermod -a -G yewu xuzhu

#从组中移除用户

[root@samba ~]# gpasswd -d duanyu caiwu

[root@samba ~]# gpasswd -d xuzhu caiwu

#2. 修改目录权限

[root@samba ~]# chmod 700 /samba_share/yewu_share

[root@samba ~]# chmod 700 /samba_share/caiwu_share

#3. 为组设定 ACL 权限

[root@samba ~]# setfacl -m g:caiwu:rwx /samba_share/caiwu_share

[root@samba ~]# setfacl -m g:caiwu:rx /samba_share/public_share

[root@samba ~]# setfacl -m g:yewu:rwx /samba_share/yewu_share

[root@samba ~]# setfacl -m g:yewu:rx /samba_share/public_share

#4. 查看 ACL 权限

[root@samba ~]# getfacl /samba_share/yewu_share

getfacl: Removing leading '/' from absolute path names

# file: samba_share/yewu_share

# owner: root

# group: root

user::rwx

group::---

group:yewu:rwx

mask::rwx

other::---

[root@samba ~]# getfacl /samba_share/caiwu_share

getfacl: Removing leading '/' from absolute path names

# file: samba_share/caiwu_share

# owner: root

# group: root

user::rwx

group::---

group:caiwu:rwx

mask::rwx

other::---

[root@samba ~]# getfacl /samba_share/public_share

getfacl: Removing leading '/' from absolute path names

# file: samba_share/public_share

# owner: root

# group: root

user::rwx

user:qiaofeng:r-x

group::---

group:caiwu:r-x

group:yewu:r-x

mask::r-x

other::---

#5. 删除 ACL 权限

[root@samba ~]# setfacl -x g:caiwu /samba_share/caiwu_share

[root@samba ~]# setfacl -x g:yewu /samba_share/yewu_share

#public_share 为共享名非共享目录

[root@samba ~]# mount -t cifs -o username=wangyuyan //192.168.1.50/public_share /mnt   

#配置自动挂载

[root@samba ~]# echo "//192.168.1.50/public_share /mnt cifs defaults,username=wangyuyan,passwd=123456 1 2" >> /etc/fstab

[root@samba ~]# mount -a

#1. 开启 smb 别名

[root@samba ~]# vim /etc/samba/smb.conf

...

[global]

        workgroup = workgroup

        security = user

        username map = /etc/samba/smbusers      #添加此行配置

...

#2. 配置 smb 别名

[root@samba ~]# vim /etc/samba/smbusers

...

wangyuyan =  zhangsan lisi #别名用户 zhangsan、lisi 登录后用于 wangyuyan 权限，权限及密码均一样