samba服務詳解

 來自：http://developer.51cto.com/art/200511/12714.htm

 

samba server的設定檔在/etc/samba/下的smb.conf開啟一個終端中輸入: gedit /etc/samba/smb.conf 也可以用vi編輯.

AD：

samba server的設定檔在/etc/samba/下的smb.conf開啟一個終端中輸入: gedit /etc/samba/smb.conf 也可以用vi編輯.由於檔案太長,我把個人認為沒有用的東東刪除了,主要是一些注釋.下面偶解釋一下主要欄位的意思.由於我的這個檔案配置過了,可能你的機器和我的不一樣.

======================= Global Settings =====================================[global] //設定samba服務整體環境workgroup = hackase //設定工作群組名server string = angel server //伺服器的名說明; hosts allow = 192.168.1. 192.168.2. 127. //限制可訪問此服務的IP範圍,預設是全部允許的,要是想設設定去掉前面的";"printcap name = /etc/printcap //印表機設定檔load printers = yes //是否共用印表機# bsd, sysv, plp, lprng, aix, hpux, qnx, cupsprinting = cups //印表機的類型.標準印表機類型包括以上幾種.; guest account = pcguest //pcguest為使用者名稱.可改去掉前邊的";"讓使用者以pcguest身份匿名登入,但保證/etc/passwd中有此人.log file = /var/log/samba/%m.log //為登入伺服器的使用者建立不同的記錄檔.max log size = 0 //記錄檔的大小,"0"代表無限制//以下是smb.conf檔案對伺服器安全層級的設定security = SHARE //安全性的層級共四種.share、user、server、domain; password server = 密碼驗證伺服器.; password level = 8 //密碼層級; username level = 8encrypt passwords = yes //使用者密碼加密,當然也可以不加密smb passwd file = /etc/samba/smbpasswd //將密碼伺服器設定為samba server.需要這個東東來指定驗證檔案.這個是檔案的路徑,如果samba server是指定的winserver這個不須要; ssl CA certFile = /usr/share/ssl/certs/ca-bundle.crtunix password sync = Yespasswd program = /usr/bin/passwd %upasswd chat = *New*password* %n\n *Retype*new*password* %n\n *passwd:*all*authentication*tokens*updated*successfully*pam password change = yes; username map = /etc/samba/smbusers //如果每個windows使用者在samba伺服器中有帳戶這個可以不設; include = /etc/samba/smb.conf.%mobey pam restrictions = yes; interfaces = 192.168.12.2/24 192.168.13.2/24 如果多網段要在這裡列出; remote announce = 192.168.1.255 192.168.2.44; local master = no; os level = 33; domain master = yes; preferred master = yes; domain logons = yes; logon script = %m.bat; logon script = %U.bat; logon path = \\%L\Profiles\%U; wins support = yes //wins server支援; wins server = w.x.y.z; wins proxy = yes //wins 代理設定dns proxy = no //dns代理設定; preserve case = no; short preserve case = no; default case = lower; case sensitive = no#============================ Share Definitions ==============================[homes] //使用者訪問自已目錄的設定comment = Home Directories //說明(以下同理)browseable = no//設定目錄可不可以別人瀏覽writeable = yes//使用者寫入自己的許可權valid users = %Screate mode = 0664directory mode = 0775; [netlogon] //此段域使用者登入目錄設定; comment = Network Logon Service; path = /usr/local/samba/lib/netlogon; guest ok = yes; writable = no; share modes = no;[Profiles]; path = /usr/local/samba/profiles; browseable = no; guest ok = yes[printers] //印表機設定comment = All Printerspath = /var/spool/sambabrowseable = noprintable = yes;[tmp] //使用者共用資源設定; comment = Temporary file space; path = /tmp //可以自訂目錄,去掉前邊的";"就OK了; read only = no //是否唯讀或可寫; public = yes;[public] //使用者共用資源設定; comment = Public Stuff; path = /home/samba; public = yes; writable = yes; printable = no; write list = @staff;[fredsprn]; comment = Fred's Printer; valid users = fred; path = /home/fred; printer = freds_printer; public = no; writable = no; printable = yes;[fredsdir]; comment = Fred's Service; path = /usr/somewhere/private; valid users = fred; public = no; writable = yes; printable = no;[pchome]; comment = PC Directories; path = /usr/local/pc/%m; public = no; writable = yes;[public]; path = /usr/somewhere/else/public; public = yes; only guest = yes; writable = yes; printable = no;[myshare]; comment = Mary's and Fred's stuff; path = /usr/somewhere/shared; valid users = mary fred; public = no; writable = yes; printable = no; create mask = 0765[my work] //偶的東東comment = is me workpath = /root/my workvalid users angelpublic = yeswriteable = yes瞭解smb.conf的檔案就好辦了.我們開始對samba server的四個安全層級分別講解.1、share級配置這個在四個等級中是最低的,方法也是最簡單.我們只要對smb.conf檔案修改一下就可以了.workgroup = hackaseserver string = angel serverhosts allow = 192.168.1. //限制192.168.1的IP網段可以防問printcap name = /etc/printcapload printers = yes //共用印表機printing = cups //印表機用linux標準的guest account = angellog file = /var/log/samba/%m.logmax log size = 20security = share===================================================================其他的設定預設就可以了,也可以像我把所有的注釋刪除.[tmp]這個欄位的";"去掉.路徑可以更改. 重啟一下服務 /etc/samba/smb restart //service smb restart 也可用testparm測試我們配置的檔案是否正確:===================================================================[root@localhost root]# testparm //測試時[printers]注釋掉了所以這裡沒有.Load smb config files from /etc/samba/smb.confProcessing section "[homes]"Processing section "[tmp]"Processing section "[my]"Loaded services file OK. //如有錯誤,會在這列出錯誤的地方.Press enter to see a dump of your service definitions==================================================================用smbclient命令查看網際網路共用情況===================================================================[root@localhost etc]# smbclient -L localhost //本機名為localhostPassword:Domain=[HACKBASE] OS=[Unix] Server=[Samba 2.2.7a]Sharename Type Comment--------- ---- -------tmp Disk Temporary file spacemy Disk is meIPC$ IPC IPC Service (angel server)ADMIN$ Disk IPC Service (angel server)root Printer Home DirectoriesServer Comment--------- -------Workgroup Master--------- -------=======================================================================2、user級配置user比share級安全層級高一點點,很簡單的,可以在share基礎上改一下就可以了.改一下security = share欄位為:security = user.在加上如下欄位:guest account = angel //機器上有這個使用者名稱,如果你沒有那就建一個吧!encrypt passwords=yessmb passwd file=/etc/samba/smbpasswd(1)產生口令檔案.#cat/etc/passwd | mksmbpasswd.sh>/etc/samba/smbpasswd本命令將產生口令檔案"/etc/samba/smbpasswd" 這個就是我們剛加上的"smb passwd file=/etc/samba/smbpasswd"(2)我們知道建賬戶是建在etc/passwd檔案裡,我們須要用smbpasswd命令為剛才建立的賬名設定samba server口令. 格式為:smbpasswd angel(3)重啟samba server服務user級的也OK了,你可以用testparm and smbclient命測試.windows使用者想訪問就要輸入angel and passwd.這個就不是誰都可以訪問你的共用資源了.3、server 級配置server級比user級也高那麼一點,只需要user級配置上修改一下就OK了.(1)security = user欄位為:security = server(2)加上password server = ****** //密碼伺服器,這個可以是你的windows主網域控制站,也可以是別一個samba server伺服器(名子無意思)(3)注釋smb passwd file=/etc/samba/smbpasswd(4)重啟samba server服務,你可以用testparm and smbclient命測試.好了,又完事一個現在如果一台windows機器登入******(password server = ******設定的)網域服務器的時候,也就同登入上了samba server,如果你以是*****主控域的電腦,那你就可以輸入你自己的帳號密碼開啟samba server的檔案了,但是你要保證*****和sambs server的帳號和密碼相同.4、domain級的配置domain級的配置是samba server中層級最高的他主要就是把samba加入到域中去,用網域服務器作samba server的密碼伺服器.其實domain級的配置也很簡單,只需要在user級的基礎上修改:(1)加入欄位:NETBLOS = main //起一個NETBLOS名,放在smb.conf檔案的最上邊password server = ** //用主網域控制站**來做密碼伺服器(2)security = user欄位為:security = domainworkgroup = ***** //*****是主網域控制站的網域名稱(3)注釋smb passwd file=/etc/samba/smbpasswd(4)重啟samba server服務,你可以用testparm and smbclient命測試.終於完事了,好在我的"彈指神功"技術純熟.這個時候我們就可以和windows系統通訊了,我也要去呼呼了,等等~~~那網路可以共用了,那麼我們原生linux系統和原生windows系統怎麼通訊啊!呵呵.當然有辦法,到現在大俠們可以起來活動活動了,幫我看看我寫的有什麼錯誤.好了,開啟終端輸入:[root@localhost root]# fdisk -l //查一下windows系統所在的分區.Disk /dev/hdb: 61.4 GB, 61492838400 bytes255 heads, 63 sectors/track, 7476 cylindersUnits = cylinders of 16065 * 512 = 8225280 bytesDevice Boot Start End Blocks Id System/dev/hdb1 * 1 738 5927953+ 7 HPFS/NTFS/dev/hdb2 739 7476 54122985 f Win95 Ext'd (LBA)/dev/hdb5 739 1480 5960083+ 7 HPFS/NTFS/dev/hdb6 1481 2383 7253316 b Win95 FAT32/dev/hdb7 3651 6200 20482843+ b Win95 FAT32/dev/hdb8 6201 7476 10249438+ b Win95 FAT32/dev/hdb9 2384 2396 104391 83 Linux/dev/hdb10 2397 3585 9550611 83 Linux/dev/hdb11 3586 3650 522081 82 Linux swap[root@localhost root]# mkdir /mnt/my //在mnt下建一個叫my的目錄(定義到那自己決定)[root@localhost root]# mount -t auto /dev/hdb7 /mnt/my //不用說了吧!這樣就可以防問windows的分區了,但是系統磁碟分割不可以是ntfs格式的.windows系統訪問linux系統要用到工具,"explore2fs"可以到http://download.enet.com.cn/html/030282000080601.html下載在工作中,大多用第二種方法.好了,我終於可以去呼呼了.感謝您看完!!