zoukankan      html  css  js  c++  java
  • Linux网络文件共享服务之samba

    一、SAMBA服务简介

      samba是1991年由Andrew Tridgel开发实现,主要用于Windows和unix文件共享。samba实现了共享文件和打印,实现在线编辑,登录SAMBA用户的身份认证,可以进行NetBIOS名称解析和外围设备共享。相关的软件包有samba,这个包主要提供smb服务。smb是Server Message Block的缩写意思是服务器消息块,IBM发布,最早是DOS网络文件共享协议。samba-client这个软件包是客户端软件,samba-common通用软件包 ,cifs-utils 也是smb客户端工具 ,samba-winbind  这个包主要有和Windows AD域相关的组件;samba服务相关进程有两个,一个是smbd 提供smb(cifs)服务 监听在TCP的139和445端口。另外一个和名称解析相关nmbd NetBIOS名称解析默认工作在UDP的137和138。如果我们访问的samba服务器不用名称解析,nmbd这个服务是可以不用开的。samba的主配置文件是/etc/samba/smb.conf,配置文件的帮助文档可以使用man smb.conf 来查看。samba同apache类似,它也有配置文件语法检测的工具: testparm [-v] [/etc/samba/smb.conf],默认情况它不需要跟samba的配置文件路径。samba除了服务端工具,还提供了客户端工具,如smbclient,mount.cifs;cifs是common internet file system的缩写,我们可以理解为它是SMB的升级协议,由微软实现。

    二、SAMBA服务配置文件说明

      /etc/samba/smb.conf继承了.ini文件的格式,用[ ]分成了不同的部分,其中全局设置是[global]语句下设置,这里主要设置服务器的通用或全局配置,除了全局配置,还有特定目录共享的设置如[homes] 用户的家目录共享,[printers] 定义打印机资源和服务,[sharename] 自定义的共享目录配置,当然自定义目录中括号的名字就是我们共享出来的目录名称,这个名称是可以和共享目录的名称不一样,它其实就是给恭喜那个目录起了一个名字而已。/etc/samba/smb.conf这个文件中以井号和分号开始的都是注释,中括号中的名称大小写不敏感。

      配置文件宏定义

      %m:客户端主机的NetBIOS名

      %H:当前用户家目录路径

      %g:当前用户所属组

      %L:samba服务器的NetBIOS名

      %T:当前日期和时间

      %M:客户端主机的FQDN

      %U:当前用户用户名

      %h:samba服务器的主机名

      %I(大写i):客户端主机的IP

      %S:可登录的用户名

      2.1、SAMBA服务器全局配置指令说明

        workgroup 指定工作组名称

         server string 主机注释信息

        netbios name 指定NetBIOS名

        interfaces 指定服务侦听接口和IP

        hosts allow 可用“,” ,空格,或tab分隔,默认允许所有主机访问,也可在每个共享独立配置,如在[global]设置,将应用并覆盖所有共享设置

          IPv4 network/prefix: 172.25.0.0/24 IPv4前缀: 172.25.0.

          IPv4 network/netmask: 172.25.0.0/255.255.255.0

          主机名: desktop.example.com

          以example.com后缀的主机名: .example.com

          示例:

            hosts allow = 172.25.

            hosts allow = 172.25. .example.com

        hosts deny 拒绝指定主机访问

        config file=/etc/samba/conf.d/%U 用户独立的配置文件

        Log file=/var/log/samba/log.%m 不同客户机采用不同日志

        log level = 2 日志级别,默认为0,不记录日志

        max log size=50 日志文件达到50K,将轮循rotate,单位KB

        Security三种认证方式:

          share:匿名(CentOS7不再支持)

          user:samba用户(采有linux用户,samba的独立口令)

          domain:使用DC(DOMAIN CONTROLLER)认证

        passdb backend = tdbsam 密码数据库格式;samba用户必须是Linux用户,为了安全建议使用/sbin/nologin的shell类型

    三、安装、配置和使用SAMBA服务

      1、安装

    [root@test ~]# yum install samba -y
    ……省略部分类容
    Installed:
      samba.x86_64 0:4.6.2-8.el7                                                                                                    
    
    Dependency Installed:
      avahi-libs.x86_64 0:0.6.31-17.el7     cups-libs.x86_64 1:1.6.3-29.el7            libldb.x86_64 0:1.1.29-1.el7               
      libtalloc.x86_64 0:2.1.9-1.el7        libtdb.x86_64 0:1.3.12-2.el7               libtevent.x86_64 0:0.9.31-1.el7            
      libwbclient.x86_64 0:4.6.2-8.el7      pytalloc.x86_64 0:2.1.9-1.el7              samba-client-libs.x86_64 0:4.6.2-8.el7     
      samba-common.noarch 0:4.6.2-8.el7     samba-common-libs.x86_64 0:4.6.2-8.el7     samba-common-tools.x86_64 0:4.6.2-8.el7    
      samba-libs.x86_64 0:4.6.2-8.el7      
    
    Complete!
    [root@test ~]# rpm -qf /etc/samba/smb.conf
    samba-common-4.6.2-8.el7.noarch
    [root@test ~]# 

      说明:安装samba服务默认会安装一些依赖的工具包,如上所示,其中配置文件/etc/samba/smb.conf文件就来自samba-common这个包。

      2、配置目录共享

    [root@test ~]# cat /etc/samba/smb.conf
    # See smb.conf.example for a more detailed config file or
    # read the smb.conf manpage.
    # Run 'testparm' to verify the config is correct after
    # you modified it.
    
    [global]
            workgroup = SAMBA
            security = user
    
            passdb backend = tdbsam
    
            printing = cups
            printcap name = cups
            load printers = yes
            cups options = raw
    
    [homes]
            comment = Home Directories
            valid users = %S, %D%w%S
            browseable = No
            read only = No
            inherit acls = Yes
    
    [printers]
            comment = All Printers
            path = /var/tmp
            printable = Yes
            create mask = 0600
            browseable = No
    
    [print$]
            comment = Printer Drivers
            path = /var/lib/samba/drivers
            write list = root
            create mask = 0664
            directory mask = 0775
    [share]
            comment = this is test share
            path = /data/smb_dir
    
    [root@test ~]# 
    

      说明:以上配置在原有的配置文件中新加了一个[share]语句块,它表示把/data/smb_dir目录共享出去,并且共享出去的名字叫share。

    [root@test ~]# testparm 
    Load smb config files from /etc/samba/smb.conf
    Processing section "[homes]"
    Processing section "[printers]"
    Processing section "[print$]"
    Processing section "[share]"
    Loaded services file OK.
    Server role: ROLE_STANDALONE
    
    Press enter to see a dump of your service definitions
    
    # Global parameters
    [global]
            workgroup = SAMBA
            printcap name = cups
            security = USER
            idmap config * : backend = tdb
            cups options = raw
    
    
    [homes]
            comment = Home Directories
            browseable = No
            inherit acls = Yes
            read only = No
            valid users = %S %D%w%S
    
    
    [printers]
            comment = All Printers
            path = /var/tmp
            browseable = No
            printable = Yes
            create mask = 0600
    
    
    [print$]
            comment = Printer Drivers
            path = /var/lib/samba/drivers
            create mask = 0664
            directory mask = 0775
            write list = root
    
    
    [share]
            comment = this is test share
            path = /data/smb_dir
    [root@test ~]# 
    

      说明:语法检查没有问题后,新建目录,然后再重启服务

    [root@test ~]# mkdir /data/smb_dir -p
    [root@test ~]# systemctl restart smb
    [root@test ~]# 
    

      说明:到此我们就把一个目录给共享出来了,接下来我们用smbclients工具来查看共享出来的目录情况

    [root@test ~]# smbclient -L 192.168.0.10
    Enter SAMBA
    oot's password: 
    Anonymous login successful
    OS=[Windows 6.1] Server=[Samba 4.6.2]
    
            Sharename       Type      Comment
            ---------       ----      -------
            print$          Disk      Printer Drivers
            share           Disk      this is test share
            IPC$            IPC       IPC Service (Samba 4.6.2)
    Anonymous login successful
    OS=[Windows 6.1] Server=[Samba 4.6.2]
    
            Server               Comment
            ---------            -------
    
            Workgroup            Master
            ---------            -------
    [root@test ~]#
    

      说明:-L选项表示列出指定主机上的共享文件列表,通常情况后面没有指定用户和密码,表示匿名用户;当然后面也可以用-U指定用户名%指定密码,如下所示

    [root@test ~]# smbclient -L 192.168.0.232 -U qiuhom%...
    Domain=[QIUHOM] OS=[Windows 7 Ultimate 7601 Service Pack 1] Server=[Windows 7 Ultimate 6.1]
    
            Sharename       Type      Comment
            ---------       ----      -------
            ADMIN$          Disk      远程管理
            C$              Disk      默认共享
            D$              Disk      默认共享
            IPC$            IPC       远程 IPC
            print$          Disk      打印机驱动程序
            Share           Disk      
    Connection to 192.168.0.232 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
    NetBIOS over TCP disabled -- no workgroup available
    [root@test ~]#
    

      3、管理SAMBA用户

      添加samba用户

    [root@test ~]# useradd  -s /sbin/nologin sambauser1
    [root@test ~]# useradd  -s /sbin/nologin sambauser2
    [root@test ~]# smbpasswd -a sambauser1
    New SMB password:
    Retype new SMB password:
    Added user sambauser1.
    [root@test ~]# smbpasswd -a sambauser2
    New SMB password:
    Retype new SMB password:
    Added user sambauser2.
    [root@test ~]#
    

      说明:samba服务的用户必须是Linux系统的用户,如果不Linux系统不存在用户,用smbpasswd 这个命令是添加不上用户的。为了Linux系统的安全,这两个账号都只用于登录samba服务,所用shell类型给修改成/sbin/nologin是比较安全的;除此之外,添加用户也可以用pdbedit命令来添加,如下所示

    [root@test ~]# useradd -s /sbin/nologin sambauser3
    [root@test ~]# pdbedit -a -u sambauser3
    new password:
    retype new password:
    Unix username:        sambauser3
    NT username:          
    Account Flags:        [U          ]
    User SID:             S-1-5-21-1369552498-1030126791-3625437691-1002
    Primary Group SID:    S-1-5-21-1369552498-1030126791-3625437691-513
    Full Name:            
    Home Directory:       \testsambauser3
    HomeDir Drive:        
    Logon Script:         
    Profile Path:         \testsambauser3profile
    Domain:               TEST
    Account desc:         
    Workstations:         
    Munged dial:          
    Logon time:           0
    Logoff time:          Wed, 06 Feb 2036 23:06:39 CST
    Kickoff time:         Wed, 06 Feb 2036 23:06:39 CST
    Password last set:    Wed, 29 Jan 2020 02:15:48 CST
    Password can change:  Wed, 29 Jan 2020 02:15:48 CST
    Password must change: never
    Last bad password   : 0
    Bad password count  : 0
    Logon hours         : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
    [root@test ~]# 
    

      说明:用pdbedit添加用户 可以看到用户账号的信息

      修改用户密码

    [root@test ~]# smbpasswd sambauser1
    New SMB password:
    Retype new SMB password:
    [root@test ~]# 
    

      说明:修改用户密码直接跟要修改密码的用户名即可,不需要指定选项

      查看samba用户列表

    [root@test ~]# pdbedit -L 
    sambauser1:1002:
    sambauser3:1004:
    sambauser2:1003:
    [root@test ~]# pdbedit -L -v
    ---------------
    Unix username:        sambauser1
    NT username:          
    Account Flags:        [U          ]
    User SID:             S-1-5-21-1369552498-1030126791-3625437691-1000
    Primary Group SID:    S-1-5-21-1369552498-1030126791-3625437691-513
    Full Name:            
    Home Directory:       \testsambauser1
    HomeDir Drive:        
    Logon Script:         
    Profile Path:         \testsambauser1profile
    Domain:               TEST
    Account desc:         
    Workstations:         
    Munged dial:          
    Logon time:           0
    Logoff time:          Wed, 06 Feb 2036 23:06:39 CST
    Kickoff time:         Wed, 06 Feb 2036 23:06:39 CST
    Password last set:    Wed, 29 Jan 2020 02:17:38 CST
    Password can change:  Wed, 29 Jan 2020 02:17:38 CST
    Password must change: never
    Last bad password   : 0
    Bad password count  : 0
    Logon hours         : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
    ---------------
    Unix username:        sambauser3
    NT username:          
    Account Flags:        [U          ]
    User SID:             S-1-5-21-1369552498-1030126791-3625437691-1002
    Primary Group SID:    S-1-5-21-1369552498-1030126791-3625437691-513
    Full Name:            
    Home Directory:       \testsambauser3
    HomeDir Drive:        
    Logon Script:         
    Profile Path:         \testsambauser3profile
    Domain:               TEST
    Account desc:         
    Workstations:         
    Munged dial:          
    Logon time:           0
    Logoff time:          Wed, 06 Feb 2036 23:06:39 CST
    Kickoff time:         Wed, 06 Feb 2036 23:06:39 CST
    Password last set:    Wed, 29 Jan 2020 02:15:48 CST
    Password can change:  Wed, 29 Jan 2020 02:15:48 CST
    Password must change: never
    Last bad password   : 0
    Bad password count  : 0
    Logon hours         : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
    ---------------
    Unix username:        sambauser2
    NT username:          
    Account Flags:        [U          ]
    User SID:             S-1-5-21-1369552498-1030126791-3625437691-1001
    Primary Group SID:    S-1-5-21-1369552498-1030126791-3625437691-513
    Full Name:            
    Home Directory:       \testsambauser2
    HomeDir Drive:        
    Logon Script:         
    Profile Path:         \testsambauser2profile
    Domain:               TEST
    Account desc:         
    Workstations:         
    Munged dial:          
    Logon time:           0
    Logoff time:          Wed, 06 Feb 2036 23:06:39 CST
    Kickoff time:         Wed, 06 Feb 2036 23:06:39 CST
    Password last set:    Wed, 29 Jan 2020 02:08:54 CST
    Password can change:  Wed, 29 Jan 2020 02:08:54 CST
    Password must change: never
    Last bad password   : 0
    Bad password count  : 0
    Logon hours         : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
    [root@test ~]# 
    

      说明:-L表示列出账号列表,-v表示列出账号的详细信息

      删除用户和密码

    [root@test ~]# smbpasswd -x sambauser3
    Deleted user sambauser3.
    [root@test ~]# pdbedit -L
    sambauser1:1002:
    sambauser2:1003:
    [root@test ~]# pdbedit -x -u sambauser2
    [root@test ~]# pdbedit -L
    sambauser1:1002:
    [root@test ~]# 
    

      说明:smbpasswd和pdbedit两个命令都是可以删除用户的,两者的区别是smbpasswd命令删除用户后要提示,pdbedit不提示

      用新建的用户去连接samba服务

    [root@test ~]# smbclient //192.168.0.10/share -U sambauser1%admin
    Domain=[TEST] OS=[Windows 6.1] Server=[Samba 4.6.2]
    smb: > ls
      .                                   D        0  Wed Jan 29 01:52:43 2020
      ..                                  D        0  Wed Jan 29 01:52:43 2020
    
                    48209924 blocks of size 1024. 45019976 blocks available
    smb: > 
    

      说明:smbclient 这个命令行工具同FTP命令行工具类似,用法都差不多。在Windows上使用就需要用UNC路径,它的格式是\sambserversharename  如下所示

       测试新建的sambauser1权限

    [root@test ~]# ls
    [root@test ~]# cp /etc/fstab  ./f1
    [root@test ~]# ls
    f1
    [root@test ~]# smbclient //192.168.0.10/share -U sambauser1%admin
    Domain=[TEST] OS=[Windows 6.1] Server=[Samba 4.6.2]
    smb: > ls
      .                                   D        0  Wed Jan 29 01:52:43 2020
      ..                                  D        0  Wed Jan 29 01:52:43 2020
    
                    48209924 blocks of size 1024. 45019800 blocks available
    smb: > !ls
    f1
    smb: > put f1
    NT_STATUS_ACCESS_DENIED opening remote file f1
    smb: > ls
      .                                   D        0  Wed Jan 29 01:52:43 2020
      ..                                  D        0  Wed Jan 29 01:52:43 2020
    
                    48209924 blocks of size 1024. 45019800 blocks available
    smb: > q
    [root@test ~]# 
    

      说明:我们往共享出来的目录里上传f1文件,它提示我们访问拒绝。这是因为说明呢?是我们的账号权限不对?还是文件系统权限不对? 这样,我们把共享出来的目录权限改成777权限,然后在上传文件看看可以上传上去不?这样就可以排除出到底是账号权限不够还是共享目录的权限太严格

    [root@test ~]# ll -d /data/smb_dir/
    drwxr-xr-x 2 root root 16 Jan 29 03:26 /data/smb_dir/
    [root@test ~]# chmod 777 /data/smb_dir/
    [root@test ~]# ll -d /data/smb_dir/
    drwxrwxrwx 2 root root 16 Jan 29 03:26 /data/smb_dir/
    [root@test ~]# smbclient //192.168.0.10/share -U sambauser1%admin
    Domain=[TEST] OS=[Windows 6.1] Server=[Samba 4.6.2]
    smb: > ls
      .                                   D        0  Wed Jan 29 03:28:39 2020
      ..                                  D        0  Wed Jan 29 01:52:43 2020
    
                    48209924 blocks of size 1024. 45019872 blocks available
    smb: > !ls
    f1
    smb: > put f1
    NT_STATUS_ACCESS_DENIED opening remote file f1
    smb: > q
    [root@test ~]# 
    

      说明:我们把共享出来的目录权限修改成777后还是不能正常上传,这是为什么呢  ?  其实我们拿sambauser1这个用户去登录samba服务器的时候,它默认是用Linux系统上的sambauser1这个用的权限去访问共享目录。所以我们在共享目录上不用给777,给sambauser1有读写执行权限就好了。它这里不能上传说明不是文件系统本身权限导致了,是因为samba服务共享出来默认权限是只读权限,所以我们要在配置文件中明却告诉samba服务,我们共享出来的目录是允许写的;接下来修改共享目录的权限为755,然后给sambauser1读写执行权限,然后在配置文件中明确指定共享目录可写

    [root@test ~]# ll -d /data/smb_dir/  
    drwxrwxrwx 2 root root 6 Jan 29 03:28 /data/smb_dir/
    [root@test ~]# chmod 755 /data/smb_dir/
    [root@test ~]# ll -d /data/smb_dir/
    drwxr-xr-x 2 root root 6 Jan 29 03:28 /data/smb_dir/
    [root@test ~]# setfacl -m u:sambauser1:rwx /data/smb_dir/
    [root@test ~]# getfacl /data/smb_dir/
    getfacl: Removing leading '/' from absolute path names
    # file: data/smb_dir/
    # owner: root
    # group: root
    user::rwx
    user:sambauser1:rwx
    group::r-x
    mask::rwx
    other::r-x
    
    [root@test ~]# tail /etc/samba/smb.conf
    [print$]
            comment = Printer Drivers
            path = /var/lib/samba/drivers
            write list = root
            create mask = 0664
            directory mask = 0775
    [share]
            comment = this is test share
            path = /data/smb_dir
            read only=No
    [root@test ~]# systemctl restart smb
    [root@test ~]# 
    

      说明:我们把共享目录的权限给sambauser1读写执行权限,并在samba的配置文件中明确配置了共享目录read only=No ,这个选项和writable=yes是一样的意思,任意选一个都表示可写,接下来我们再来测试是否可正常上传文件

    [root@test ~]# smbclient //192.168.0.10/share -U sambauser1%admin
      main=[TEST] OS=[Windows 6.1] Server=[Samba 4.6.2]
    smb: > ls
      .                                   D        0  Wed Jan 29 03:28:39 2020
      ..                                  D        0  Wed Jan 29 01:52:43 2020
    
                    48209924 blocks of size 1024. 45019860 blocks available
    smb: > !ls
    f1
    smb: > put f1 
    putting file f1 as f1 (97.8 kb/s) (average 97.9 kb/s)
    smb: > ls
      .                                   D        0  Wed Jan 29 03:42:51 2020
      ..                                  D        0  Wed Jan 29 01:52:43 2020
      f1                                  A      501  Wed Jan 29 03:42:51 2020
    
                    48209924 blocks of size 1024. 45019724 blocks available
    smb: > q
    [root@test ~]# ls /data/smb_dir/
    f1
    [root@test ~]# ll /data/smb_dir/
    total 4
    -rwxr--r-- 1 sambauser1 sambauser1 501 Jan 29 03:42 f1
    [root@test ~]#

      说明:可以看到我们把f1文件已经成功上传上去了,在共享的真正目录里也看到了f1文件,但是上传上去的权限有点不对,我们希望上传到服务器上的文件不拥有执行权限。我们如果要对上传和新建的文件和目录有权限的限制,还需要在配置文件中指定,新建文件的权限和目录的权限

    [root@test ~]# tail -6 /etc/samba/smb.conf
    [share]
            comment = this is test share
            path = /data/smb_dir
            read only=No
            create mask=0644
            directory mask=0755
    [root@test ~]# systemctl restart smb
    [root@test ~]# smbclient //192.168.0.10/share -U sambauser1%admin
    Domain=[TEST] OS=[Windows 6.1] Server=[Samba 4.6.2]
    smb: > ls 
      .                                   D        0  Wed Jan 29 04:03:19 2020
      ..                                  D        0  Wed Jan 29 03:58:37 2020
    
                    48209924 blocks of size 1024. 45019496 blocks available
    smb: > !ls
    f1  passwd
    smb: > mput f1 passwd 
    Put file f1? y
    putting file f1 as f1 (122.3 kb/s) (average 122.3 kb/s)
    Put file passwd? y
    putting file passwd as passwd (645.0 kb/s) (average 296.5 kb/s)
    smb: > mkdir newdir
    smb: > ls
      .                                   D        0  Wed Jan 29 04:04:10 2020
      ..                                  D        0  Wed Jan 29 03:58:37 2020
      f1                                  N      501  Wed Jan 29 04:04:02 2020
      passwd                              N     1321  Wed Jan 29 04:04:03 2020
      newdir                              D        0  Wed Jan 29 04:04:10 2020
    
                    48209924 blocks of size 1024. 45019436 blocks available
    smb: > q
    [root@test ~]# ll /data/smb_dir/     
    total 8
    -rw-r--r-- 1 sambauser1 sambauser1  501 Jan 29 04:04 f1
    drwxr-xr-x 2 sambauser1 sambauser1    6 Jan 29 04:04 newdir
    -rw-r--r-- 1 sambauser1 sambauser1 1321 Jan 29 04:04 passwd
    [root@test ~]# 
    

      说明:我们在配置文件中给指定共享目录里明确指定新建文件的权限和目录权限后,上传和新建目录的权限就没有问题了

      基于特定用户和组的共享

    [root@test ~]# tail -6 /etc/samba/smb.conf
    [share2]
            path=/data/smb_dir2
            writeable=no
            valid users=sambauser2,sambauser3
            browseable=no
            write list=sambauser2
    [root@test ~]# mkdir /data/smb_dir2
    [root@test ~]# getent passwd sambauser2
    sambauser2:x:1003:1003::/home/sambauser2:/sbin/nologin
    [root@test ~]# getent passwd sambauser3
    sambauser3:x:1004:1004::/home/sambauser3:/sbin/nologin
    [root@test ~]# pdbedit -a -u sambauser2
    new password:
    retype new password:
    Unix username:        sambauser2
    NT username:          
    Account Flags:        [U          ]
    User SID:             S-1-5-21-1369552498-1030126791-3625437691-1004
    Primary Group SID:    S-1-5-21-1369552498-1030126791-3625437691-513
    Full Name:            
    Home Directory:       \testsambauser2
    HomeDir Drive:        
    Logon Script:         
    Profile Path:         \testsambauser2profile
    Domain:               TEST
    Account desc:         
    Workstations:         
    Munged dial:          
    Logon time:           0
    Logoff time:          Wed, 06 Feb 2036 23:06:39 CST
    Kickoff time:         Wed, 06 Feb 2036 23:06:39 CST
    Password last set:    Wed, 29 Jan 2020 04:19:09 CST
    Password can change:  Wed, 29 Jan 2020 04:19:09 CST
    Password must change: never
    Last bad password   : 0
    Bad password count  : 0
    Logon hours         : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
    [root@test ~]# pdbedit -a -u sambauser3
    new password:
    retype new password:
    Unix username:        sambauser3
    NT username:          
    Account Flags:        [U          ]
    User SID:             S-1-5-21-1369552498-1030126791-3625437691-1005
    Primary Group SID:    S-1-5-21-1369552498-1030126791-3625437691-513
    Full Name:            
    Home Directory:       \testsambauser3
    HomeDir Drive:        
    Logon Script:         
    Profile Path:         \testsambauser3profile
    Domain:               TEST
    Account desc:         
    Workstations:         
    Munged dial:          
    Logon time:           0
    Logoff time:          Wed, 06 Feb 2036 23:06:39 CST
    Kickoff time:         Wed, 06 Feb 2036 23:06:39 CST
    Password last set:    Wed, 29 Jan 2020 04:19:19 CST
    Password can change:  Wed, 29 Jan 2020 04:19:19 CST
    Password must change: never
    Last bad password   : 0
    Bad password count  : 0
    Logon hours         : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
    [root@test ~]# pdbedit -L
    sambauser2:1003:
    sambauser1:1002:
    sambauser3:1004:
    [root@test ~]# setfacl -m u:sambauser2:rwx /data/smb_dir2
    [root@test ~]# setfacl -m u:sambauser3:rwx /data/smb_dir2 
    [root@test ~]# getfacl /data/smb_dir2
    getfacl: Removing leading '/' from absolute path names
    # file: data/smb_dir2
    # owner: root
    # group: root
    user::rwx
    user:sambauser2:rwx
    user:sambauser3:rwx
    group::r-x
    mask::rwx
    other::r-x
    
    [root@test ~]# systemctl restart smb
    [root@test ~]# 
    

      说明:以上在samba服务上有重新共享了一个目录为share2 ,这个共享目录只能有sambauser2和sambauser3这两个用户才能访问其他用户没法访问;sambauser2对这个共享目录可写,sambauser3对其不可写,接下来测试下是否是这样的

    [root@test ~]# smbclient -L 192.168.0.10 -U sambauser1%admin
    Domain=[TEST] OS=[Windows 6.1] Server=[Samba 4.6.2]
    
            Sharename       Type      Comment
            ---------       ----      -------
            print$          Disk      Printer Drivers
            share           Disk      this is test share
            IPC$            IPC       IPC Service (Samba 4.6.2)
            sambauser1      Disk      Home Directories
    Domain=[TEST] OS=[Windows 6.1] Server=[Samba 4.6.2]
    
            Server               Comment
            ---------            -------
    
            Workgroup            Master
            ---------            -------
    [root@test ~]# smbclient -L 192.168.0.10 -U sambauser2%admin
    Domain=[TEST] OS=[Windows 6.1] Server=[Samba 4.6.2]
    
            Sharename       Type      Comment
            ---------       ----      -------
            print$          Disk      Printer Drivers
            share           Disk      this is test share
            IPC$            IPC       IPC Service (Samba 4.6.2)
            sambauser2      Disk      Home Directories
    Domain=[TEST] OS=[Windows 6.1] Server=[Samba 4.6.2]
    
            Server               Comment
            ---------            -------
    
            Workgroup            Master
            ---------            -------
    [root@test ~]# 
    

      说明:从上面的信息看,sambauser1和sambauser2都是看不到share2这个共享目录的,因为我们在配置文件中设置了browsable=no,这个就表示不允许所有用户看到此共享目录,也就是把此共享给隐藏了

    [root@test ~]# smbclient  //192.168.0.10/share2 -U sambauser1%admin  
    Domain=[TEST] OS=[Windows 6.1] Server=[Samba 4.6.2]
    tree connect failed: NT_STATUS_ACCESS_DENIED
    [root@test ~]# smbclient  //192.168.0.10/share2 -U sambauser2%admin 
    Domain=[TEST] OS=[Windows 6.1] Server=[Samba 4.6.2]
    smb: > ls
      .                                   D        0  Wed Jan 29 04:17:15 2020
      ..                                  D        0  Wed Jan 29 04:17:15 2020
    
                    48209924 blocks of size 1024. 45019880 blocks available
    smb: > q
    [root@test ~]#
    

      说明:sambauser1访问share2被拒绝了,sambauser2是可以正常访问的,说明我们设置的针对特定目录让特定的用户访问是可以的,如果是针对组的话,需要在配置文件中写组名,组名前用@或者+就表示组名,否则它会认为你写的是用户名称

    [root@test ~]# smbclient  //192.168.0.10/share2 -U sambauser2%admin
    Domain=[TEST] OS=[Windows 6.1] Server=[Samba 4.6.2]
    smb: > ls
      .                                   D        0  Wed Jan 29 04:17:15 2020
      ..                                  D        0  Wed Jan 29 04:17:15 2020
    
                    48209924 blocks of size 1024. 45019880 blocks available
    smb: > !ls
    f1  passwd
    smb: > put f1 
    putting file f1 as f1 (61.2 kb/s) (average 61.2 kb/s)
    smb: > ls
      .                                   D        0  Wed Jan 29 04:34:20 2020
      ..                                  D        0  Wed Jan 29 04:17:15 2020
      f1                                  A      501  Wed Jan 29 04:34:20 2020
    
                    48209924 blocks of size 1024. 45019788 blocks available
    smb: > q
    [root@test ~]# smbclient  //192.168.0.10/share2 -U sambauser3%admin
    Domain=[TEST] OS=[Windows 6.1] Server=[Samba 4.6.2]
    smb: > ls
      .                                   D        0  Wed Jan 29 04:34:20 2020
      ..                                  D        0  Wed Jan 29 04:17:15 2020
      f1                                  A      501  Wed Jan 29 04:34:20 2020
    
                    48209924 blocks of size 1024. 45019788 blocks available
    smb: > put passwd 
    NT_STATUS_ACCESS_DENIED opening remote file passwd
    smb: > ls
      .                                   D        0  Wed Jan 29 04:34:20 2020
      ..                                  D        0  Wed Jan 29 04:17:15 2020
      f1                                  A      501  Wed Jan 29 04:34:20 2020
    
                    48209924 blocks of size 1024. 45019868 blocks available
    smb: > q
    [root@test ~]# 
    

      说明:我们用sambauser2登录到share2里面是可以正常上传文件,但是sambauser3在里面上传文件被拒绝了,说明我们设置的针对特定的用户给特定的权限也是实现了。  

      实现不同的用户访问同一共享名称后,以不同的权限进入不同目录

    [root@test ~]# vim /etc/samba/smb.conf
      
    # See smb.conf.example for a more detailed config file or
    # read the smb.conf manpage.
    # Run 'testparm' to verify the config is correct after
    # you modified it.
    
    [global]
            workgroup = SAMBA
            security = user
            config file=/etc/samba/conf.d/%U
            passdb backend = tdbsam
    
            printing = cups
            printcap name = cups
            load printers = yes
            cups options = raw
    
    [homes]
            comment = Home Directories
            valid users = %S, %D%w%S
            browseable = No
            read only = No
            inherit acls = Yes
    
    [printers]
            comment = All Printers
            path = /var/tmp
            printable = Yes
            create mask = 0600
            browseable = No
    
    [print$]
            comment = Printer Drivers
            path = /var/lib/samba/drivers
            write list = root
            create mask = 0664
            directory mask = 0775
    [share]
    "/etc/samba/smb.conf" 48L, 930C written                                                                       
    [root@test ~]# mkdir -p /etc/samba/conf.d/
    [root@test ~]# cat >/etc/samba/conf.d/sambauser2
    [share2]      
    path=/smb/sambauser2/
    read only=no
    ^C
    [root@test ~]# cat /etc/samba/conf.d/sambauser2
    [share2]
    path=/smb/sambauser2/
    read only=no
    [root@test ~]# mkdir -pv /smb/sambauser2
    mkdir: created directory ‘/smb’
    mkdir: created directory ‘/smb/sambauser2’
    [root@test ~]# setfacl -m u:sambauser2:rwx /smb/sambauser2
    [root@test ~]# getfacl /smb/sambauser2
    getfacl: Removing leading '/' from absolute path names
    # file: smb/sambauser2
    # owner: root
    # group: root
    user::rwx
    user:sambauser2:rwx
    group::r-x
    mask::rwx
    other::r-x
    
    [root@test ~]# touch /smb/sambauser2/smb_user2.txt
    [root@test ~]# systemctl restart smb
    [root@test ~]# 
    

      说明:以上配置表达的意思是sambauser2访问share2这个共享目录时,它和sambauser3访问share2时不时访问的同一目录。我们在主配置文件中的全局配置中加上了config file=/etc/samba/conf.d/%U 这句话表示用户访问共享目录时代配置文件是/etc/samba/conf.d/和用户名同名的文件。这个和FTP那个配置有点类似,用户访问服务器,读取不同的配合文件。这样就实现了不同的用户拥有各自的配置文件。当然如果这个目录下没有当前访问用户的配置文件,那么他就是用主配置文件中的配置生效。接下来测试下,看看sambauser2访问share2这个共享目录时,是不是访问的我们给指定的目录下了,如果是,我们可以看到smb_user2.txt这个文件

    [root@test ~]# smbclient //192.168.0.10/share2 -U sambauser2%admin
    Domain=[TEST] OS=[Windows 6.1] Server=[Samba 4.6.2]
    smb: > ls
      .                                   D        0  Wed Jan 29 04:54:52 2020
      ..                                  D        0  Wed Jan 29 04:53:38 2020
      smb_user2.txt                       N        0  Wed Jan 29 04:54:52 2020
    
                    48209924 blocks of size 1024. 45019672 blocks available
    smb: > !ls
    f1  passwd
    smb: > mkdir user2
    smb: > ls
      .                                   D        0  Wed Jan 29 05:05:25 2020
      ..                                  D        0  Wed Jan 29 04:53:38 2020
      smb_user2.txt                       N        0  Wed Jan 29 04:54:52 2020
      user2                               D        0  Wed Jan 29 05:05:25 2020
    
                    48209924 blocks of size 1024. 45019600 blocks available
    smb: > q
    [root@test ~]# smbclient //192.168.0.10/share2 -U sambauser3%admin
    Domain=[TEST] OS=[Windows 6.1] Server=[Samba 4.6.2]
    smb: > ls
      .                                   D        0  Wed Jan 29 04:34:20 2020
      ..                                  D        0  Wed Jan 29 04:17:15 2020
      f1                                  A      501  Wed Jan 29 04:34:20 2020
    
                    48209924 blocks of size 1024. 45019792 blocks available
    smb: > q
    [root@test ~]# 

      说明:可以看到sambauser2访问share2 是可以看到smb_user2.txt,说明他访问的目录是/smb/sambauser2这个目录,况且他也是可以在里面创建目录的,说明写的权限生效了;sambauser3访问share2则访问的是主配置文件中定义目录中的文件

      实现不同的客户机采用不同的日志

    [root@test ~]# grep -v ^"#" /etc/samba/smb.conf|head
    
    [global]
            workgroup = SAMBA
            security = user
            config file=/etc/samba/conf.d/%U
    
            log file=/var/log/samba/log.%m
            log level=2
    
            passdb backend = tdbsam
    [root@test ~]# 
    

      说明:以上配置表示不同的客户端主机访问就把日志记录到/var/log/samba/log.客户端主机名结尾的日志文件中

    [root@test ~]# systemctl restart smb
    [root@test ~]# ll /var/log/samba/
    total 4
    drwx------ 3 root root   18 Jan 29 01:43 cores
    -rw-r--r-- 1 root root 3670 Jan 29 05:17 log.smbd
    drwx------ 2 root root    6 Aug  7  2017 old
    [root@test ~]# smbclient //192.168.0.10/share2 -U sambauser2%admin
    Domain=[TEST] OS=[Windows 6.1] Server=[Samba 4.6.2]
    smb: > ls
      .                                   D        0  Wed Jan 29 05:05:25 2020
      ..                                  D        0  Wed Jan 29 04:53:38 2020
      smb_user2.txt                       N        0  Wed Jan 29 04:54:52 2020
      user2                               D        0  Wed Jan 29 05:05:25 2020
    
                    48209924 blocks of size 1024. 45019916 blocks available
    smb: > q
    [root@test ~]# ll /var/log/samba/
    total 12
    drwx------ 3 root root   18 Jan 29 01:43 cores
    -rw-r--r-- 1 root root  754 Jan 29 05:18 log.192.168.0.10
    -rw-r--r-- 1 root root 3670 Jan 29 05:17 log.smbd
    -rw-r--r-- 1 root root  625 Jan 29 05:18 log.test
    drwx------ 2 root root    6 Aug  7  2017 old
    [root@test ~]# cat /var/log/samba/log.test 
    [2020/01/29 05:18:28.232515,  2] ../source3/param/loadparm.c:2769(lp_do_section)
      Processing section "[share2]"
    [2020/01/29 05:18:28.232705,  2] ../source3/lib/interface.c:345(add_interface)
      added interface ens33 ip=192.168.0.10 bcast=192.168.0.255 netmask=255.255.255.0
    [2020/01/29 05:18:28.234784,  2] ../source3/smbd/service.c:822(make_connection_snum)
      test (ipv4:192.168.0.10:33624) connect to service share2 initially as user sambauser2 (uid=1003, gid=1003) (pid 10105)
    [2020/01/29 05:18:33.956451,  2] ../source3/smbd/service.c:1098(close_cnum)
      test (ipv4:192.168.0.10:33624) closed connection to service share2
    [root@test ~]#
    

      说明:可看到修改配置文件后,重启服务,在对应的目录下是没有生成日志文件的,然后我们通过访问samba共享的目录,在对应的目录下生成了以主机名结尾的日志文件和ip地址结尾的日志文件。里面记录了客户端的主机名信息,IP地址和端口信息,还有访问了那个共享目录和以那个用户身份访问的

    四、挂载CIFS文件系统

      上面我们演示了管理和配置samba的共享目录,但是都是用smbclient 工具去和samba交互使用的。接下来我们演示下怎么挂载cifs文件系统

      手动挂载

    [root@test ~]# df
    文件系统                   1K-块     已用     可用 已用% 挂载点
    /dev/mapper/centos-root 27560808 13929596 13631212   51% /
    devtmpfs                  923148        0   923148    0% /dev
    tmpfs                     935012        0   935012    0% /dev/shm
    tmpfs                     935012    17204   917808    2% /run
    tmpfs                     935012        0   935012    0% /sys/fs/cgroup
    /dev/sda2                1038336   221032   817304   22% /boot
    /dev/sda1                 204580    11364   193216    6% /boot/efi
    tmpfs                     187004        0   187004    0% /run/user/1000
    [root@test ~]# mount -t cifs -o username=sambauser2,password=admin //192.168.0.10/share2 /mnt
    [root@test ~]# df
    文件系统                   1K-块     已用     可用 已用% 挂载点
    /dev/mapper/centos-root 27560808 13930088 13630720   51% /
    devtmpfs                  923148        0   923148    0% /dev
    tmpfs                     935012        0   935012    0% /dev/shm
    tmpfs                     935012    17204   917808    2% /run
    tmpfs                     935012        0   935012    0% /sys/fs/cgroup
    /dev/sda2                1038336   221032   817304   22% /boot
    /dev/sda1                 204580    11364   193216    6% /boot/efi
    tmpfs                     187004        0   187004    0% /run/user/1000
    //192.168.0.10/share2   48209924  3190212 45019712    7% /mnt
    [root@test ~]# cd /mnt
    [root@test mnt]# ls
    smb_user2.txt  user2
    [root@test mnt]# 
    

      说明:手动挂载需要指定文件系统类型和挂载选项用户名和密码来进行挂载,这样存在不安全风险,别人登录到Linux系统上查看命令历史,我们的用户名和密码就泄露了,所以还是不建议手动挂载

      开机自动挂载

    [root@test ~]# df
    文件系统                   1K-块     已用     可用 已用% 挂载点
    /dev/mapper/centos-root 27560808 13929600 13631208   51% /
    devtmpfs                  923148        0   923148    0% /dev
    tmpfs                     935012        0   935012    0% /dev/shm
    tmpfs                     935012    17204   917808    2% /run
    tmpfs                     935012        0   935012    0% /sys/fs/cgroup
    /dev/sda2                1038336   221032   817304   22% /boot
    /dev/sda1                 204580    11364   193216    6% /boot/efi
      pfs                     187004        0   187004    0% /run/user/1000
    ▽/192.168.0.10/share2   48209924  3190116 45019808    7% /mnt
    [root@test ~]# umount /mnt
    [root@test ~]# df
    文件系统                   1K-块     已用     可用 已用% 挂载点
    /dev/mapper/centos-root 27560808 13929600 13631208   51% /
    devtmpfs                  923148        0   923148    0% /dev
    tmpfs                     935012        0   935012    0% /dev/shm
    tmpfs                     935012    17204   917808    2% /run
    tmpfs                     935012        0   935012    0% /sys/fs/cgroup
    /dev/sda2                1038336   221032   817304   22% /boot
    /dev/sda1                 204580    11364   193216    6% /boot/efi
    tmpfs                     187004        0   187004    0% /run/user/1000
    [root@test ~]# echo '//192.168.0.10/share2 /mnt cifs credentials=/etc/samba/smb.txt 0 0' >> /etc/fstab 
    [root@test ~]# tail -1 /etc/fstab
    //192.168.0.10/share2 /mnt cifs credentials=/etc/samba/smb.txt 0 0
    [root@test ~]# cat >/etc/samba/smb.txt
    username=sambauser2
    password=admin
    ^C
    [root@test ~]# cat /etc/samba/smb.txt
    username=sambauser2
    password=admin
    [root@test ~]# ll /etc/samba/smb.txt
    -rw-r--r-- 1 root root 35 1月  31 02:01 /etc/samba/smb.txt
    [root@test ~]# chmod 600 /etc/samba/smb.txt
    [root@test ~]# ll /etc/samba/smb.txt
    -rw------- 1 root root 35 1月  31 02:01 /etc/samba/smb.txt
    [root@test ~]# mount -a
    mount: 文件系统类型错误、选项错误、//192.168.0.10/share2 上有坏超级块、
           缺少代码页或助手程序,或其他错误
           (对某些文件系统(如 nfs、cifs) 您可能需要
           一款 /sbin/mount.<类型> 助手程序)
    
           有些情况下在 syslog 中可以找到一些有用信息- 请尝试
           dmesg | tail  这样的命令看看。
    [root@test ~]#
    

      说明:我们需要在/etc/fstab 写好挂载策略。上面写好各个配置文件后,测试挂载出现错误,让我们用dmesg|tail 查看错误信息

    [root@test ~]# dmesg | tail
    [2046006.177249] CIFS VFS: No username specified
    [2046044.418403] No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3 (or SMB2.1) specify vers=1.0 on mount.
    

      说明:在网上查了大半天,原因是客户端没有安装cifs-utils包,安装上在测试挂载就没有问题

    [root@test ~]# yum install cifs-utils
    已加载插件:fastestmirror
    Loading mirror speeds from cached hostfile
     * base: mirrors.aliyun.com
     * extras: mirrors.aliyun.com
     * updates: mirrors.aliyun.com
    正在解决依赖关系
    --> 正在检查事务
    ---> 软件包 cifs-utils.x86_64.0.6.2-10.el7 将被 安装
    --> 解决依赖关系完成
    
    依赖关系解决
    
    ===========================================================================================================================================================================
     Package                                    架构                                   版本                                         源                                    大小
    ===========================================================================================================================================================================
    正在安装:
     cifs-utils                                 x86_64                                 6.2-10.el7                                   base                                  85 k
    
    事务概要
    ===========================================================================================================================================================================
    安装  1 软件包
    
    总下载量:85 k
    安装大小:175 k
    Is this ok [y/d/N]: y
    Downloading packages:
    cifs-utils-6.2-10.el7.x86_64.rpm                                                                                                                    |  85 kB  00:00:00     
    Running transaction check
    Running transaction test
    Transaction test succeeded
    Running transaction
      正在安装    : cifs-utils-6.2-10.el7.x86_64                                                                                                                           1/1 
      验证中      : cifs-utils-6.2-10.el7.x86_64                                                                                                                           1/1 
    
    已安装:
      cifs-utils.x86_64 0:6.2-10.el7                                                                                                                                           
    
    完毕!
    [root@test ~]# mount -a
    [root@test ~]# df
    文件系统                   1K-块     已用     可用 已用% 挂载点
    /dev/mapper/centos-root 27560808 13931160 13629648   51% /
    devtmpfs                  923148        0   923148    0% /dev
    tmpfs                     935012        0   935012    0% /dev/shm
    tmpfs                     935012    17204   917808    2% /run
    tmpfs                     935012        0   935012    0% /sys/fs/cgroup
    /dev/sda2                1038336   221032   817304   22% /boot
    /dev/sda1                 204580    11364   193216    6% /boot/efi
    tmpfs                     187004        0   187004    0% /run/user/1000
    //192.168.0.10/share2   48209924  3190200 45019724    7% /mnt
    [root@test ~]# ls /mnt
    smb_user2.txt  user2  xxx
    [root@test ~]# 
    

      说明:把用户名和密码写到一个配置文件中,这样相对要比写在命令行里要安全一点。以上就是Linux系统上挂载cifs文件系统全部步骤。在windows 上我们一般都是把共享目录映射成一个盘符,然后使用就如同使用本机磁盘一样,具体操作如下

      右键计算机------->选择映射网络驱动器

       点击确定后我们就把samba共享的文件就映射到Windows上的一个网络磁盘。这个时候我们访问共享目录就像访问本地磁盘一样。

  • 相关阅读:
    MySQL数据库可以用任意ip连接访问的方法
    Docker packaging guide for Python
    Alpine makes Python Docker builds 50× slower, and images 2× larger
    hasura graphql-engine v1.0 发布了
    edgedb 1.0 Alpha 2 了
    aceql-http docker 试用
    deno学习五 typescript + vscode 集成
    makeself 试用
    poolifier nodejs 线程池工具
    Java Command Line Parsers Comparison
  • 原文地址:https://www.cnblogs.com/qiuhom-1874/p/12237973.html
Copyright © 2011-2022 走看看