學習筆記之samba伺服器架設

Samba
    特點：支援跨平台的檔案分享權限設定
          增加了一些存取控制，許可權

samba-client.i386
samba-common.i386
samba.i386

    配置目錄： /etc/samba
    設定檔： smb.conf

[global]
        workgroup = MYGROUP
        server string = Samba Server Version %v
        # logs split per machine
        # max 50KB per log file, then rotate
        security = user <-- share,server,ads,domain
        passdb backend = tdbsam
        # the login script name depends on the machine name
        # the login script name depends on the unix user used
        # disables profiles support by specifing an empty path
        load printers = yes
        cups options = raw
        #obtain list of printers automatically on SystemV
[homes]
        comment = Home Directories
        browseable = no <--匿名掃描或者別的帳號掃描是不能看到該資源
        writable = yes  <--可寫
[printers]
        comment = All Printers
        path = /var/spool/samba
        browseable = no
        guest ok = no
        writable = no
        printable = yes

 

一、安裝

[root@www ~]# yum install samba* -y
Loaded plugins: rhnplugin, security
This system is not registered with RHN.
RHN support will be disabled.
Setting up Install Process
Parsing package install arguments
Resolving Dependencies
--> Running transaction check
---> Package samba-client.i386 0:3.0.33-3.14.el5 set to be updated
---> Package samba-common.i386 0:3.0.33-3.14.el5 set to be updated
---> Package samba-swat.i386 0:3.0.33-3.14.el5 set to be updated
---> Package samba.i386 0:3.0.33-3.14.el5 set to be updated
--> Processing Dependency: perl(Convert::ASN1) for package: samba
--> Running transaction check
---> Package perl-Convert-ASN1.noarch 0:0.20-1.1 set to be updated
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
 Package               Arch       Version              Repository          Size
================================================================================
Installing:
 samba                 i386       3.0.33-3.14.el5      rhel-debuginfo      16 M
 samba-swat            i386       3.0.33-3.14.el5      rhel-debuginfo     8.2 M
Updating:
 samba-client          i386       3.0.33-3.14.el5      rhel-debuginfo     5.7 M
 samba-common          i386       3.0.33-3.14.el5      rhel-debuginfo     8.7 M
Installing for dependencies:
 perl-Convert-ASN1     noarch     0.20-1.1             rhel-debuginfo      41 k

Transaction Summary
================================================================================
Install      3 Package(s)        
Update       2 Package(s)        
Remove       0 Package(s)        

Total download size: 39 M
Downloading Packages:
(1/5): perl-Convert-ASN1-0.20-1.1.noarch.rpm             |  41 kB     00:00    
(2/5): samba-client-3.0.33-3.14.el5.i386.rpm             | 5.7 MB     00:01    
(3/5): samba-swat-3.0.33-3.14.el5.i386.rpm               | 8.2 MB     00:01    
(4/5): samba-common-3.0.33-3.14.el5.i386.rpm             | 8.7 MB     00:02    
(5/5): samba-3.0.33-3.14.el5.i386.rpm                    |  16 MB     00:03    
--------------------------------------------------------------------------------
Total                                           3.8 MB/s |  39 MB     00:10    
Running rpm_check_debug
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
  Updating       : samba-common                                      [1/7]
  Updating       : samba-client                                      [2/7]
  Installing     : perl-Convert-ASN1                                 [3/7]
  Installing     : samba                                             [4/7]
  Installing     : samba-swat                                        [5/7]
  Cleanup        : samba-client                                      [6/7]
  Cleanup        : samba-common                                      [7/7]

Installed: samba.i386 0:3.0.33-3.14.el5 samba-swat.i386 0:3.0.33-3.14.el5
Dependency Installed: perl-Convert-ASN1.noarch 0:0.20-1.1
Updated: samba-client.i386 0:3.0.33-3.14.el5 samba-common.i386 0:3.0.33-3.14.el5
Complete!
You have new mail in /var/spool/mail/root

 

 

二、配置共用檔案

Samba伺服器使用的帳號的是系統必須存在的帳號，但帳號的密碼是samba獨立

 

[root@www ~]# useradd wych
You have new mail in /var/spool/mail/root
[root@www ~]# passwd wych
Changing password for user wych.
New UNIX password:
BAD PASSWORD: it is WAY too short
Retype new UNIX password:
passwd: all authentication tokens updated successfully.
[root@www ~]# servce smb restart
-bash: servce: command not found
[root@www ~]# service smb restart
Shutting down SMB services:                                [FAILED]
Shutting down NMB services:                                [FAILED]
Starting SMB services:                                     [  OK  ]
Starting NMB services:                                     [  OK  ]
[root@www ~]# service smb restart
[root@www ~]# useradd wych
You have new mail in /var/spool/mail/root
[root@www ~]# passwd wych
Changing password for user wych.
New UNIX password:
BAD PASSWORD: it is WAY too short
Retype new UNIX password:
passwd: all authentication tokens updated successfully.
[root@www ~]# smbpasswd wych
New SMB password:
Retype new SMB password:
Failed to find entry for user wych.
Failed to modify password entry for user wych
You have new mail in /var/spool/mail/root

 

 

例子1：

Samba伺服器使用的帳號的是系統必須存在的帳號，但帳號的密碼是samba獨立
[root@squid conf]# smbpasswd  -a tom
New SMB password:
Retype new SMB password:
Added user tom.
[root@squid conf]# smbpasswd  -a bean
New SMB password:
Retype new SMB password:
Added user bean.

Service smb restart

匿名掃描
smbclient -L //10.1.1.21
使用某個帳號列出資源
# smbclient -L //10.1.1.21  -U tom
訪問資源
smbclient  //10.1.1.21/bean  -U bean

例子2:增加自訂共用

[uplooking]
        comment = Just for test
        path = /www
        browseable = yes
        guest ok = no
        writable = no

# smbclient //10.1.1.21/uplooking
Password:
Anonymous login successful
Domain=[MYGROUP] OS=[Unix] Server=[Samba 3.0.33-3.7.el5]
tree connect failed: NT_STATUS_ACCESS_DENIED

# smbclient //10.1.1.21/uplooking -U tom

在user模式下，把資源讓匿名可以訪問，資源可寫
        public = yes  《－－ guest ok =yes
        read only = no <--- writeable = yes

在windows下訪問的格式
//10.1.1.21/uplooking
關閉已經建立好的資源訪問
net use * /del /y
在user模式下，就算是訪問匿名資源也必須提供帳號，所以說，不能訪問

更改成share模式之後：
security = share

例子3：關於可寫資源檔的許可權問題

使用兩個獨立帳號分別上傳檔案，發現可以相互刪除，原因：只要擁有者對檔案有寫的許可權，其他帳號就可以對它進行刪除。

怎麼去解決？讓別人不能隨便刪除其他的檔案。

對資來源目錄設定stick bit
chmod o+t /www

第2種辦法：
    讓檔案上傳之後，自動去掉擁有者寫入權限
        create mask = 0444  <--對於這樣的許可權，擁有者也不能刪除自己的檔案
        directory mask = 0755   

例子4: 存取控制，必須把層級改成user

控制資源參數
    write list = tom <--如果存在read only = no 那麼write list失效
    valid users = tom,bean <--- invalid users =

控制訪問來源

        hosts deny = 10.1.1.
        hosts allow = 10.1.1.20  《－－只允許10.1.1.20訪問，別的都拒絕
總結：當deny和allow重疊的時候，allow說了算。

    實現拒絕所有人訪問，但是10.1.1.0/24可以訪問,但是10.1.1.20不允訪問
    hosts deny = all
    hosts allow = 10.1.1. EXCEPT 10.1.1.20

    如果使用網域名稱來實現，那麼必須DNS支援正向和方向解析
    hosts allow = .upl.com

例子5： 在user模式下，實現tom可以上傳下載，bean只能下載，其他使用者不能登入，拒絕匿名訪問。

    valid users = tom,bean
    guest ok = no
    write list = tom
    read list = bean <---可選