(Linux下的samba服务配置详解)
一、Samba介绍
1.SMB（Server Messages Block，信息服务块）是一种在局域网上共享文件和打印机的一种通信协议，它为局域网内的不同计算机之间提供文件及打印机等资源的共享服务。 2.Samba是在Linux和UNIX系统上实现SMB协议的一个免费软件，由服务器及客户端程序构成。 3.其他相关概念： CIFS：common internet file system，微软基于SMB发布。 NFS:网络文件系统，英文Network File System(NFS)，是由SUN公司研制的UNIX表示层协议(presentation layer protocol)，能使使用者访问网络上别处的文件就像在使用自己的计算机一样。
二、Samba工具及特性
1.相关包 ①amba 提供smb服务 ②samba-client 客户端软件 ③samba-common 通用软件 ④cifs-utils smb客户端工具 ⑤samba-winbind 和AD相关
2.相关服务进程 smbd 提供smb（cifs）服务 TCP:139,445 nmbd NetBIOS名称解析 UDP:137,138 3.相关工具及命令 主配置文件：/etc/samba/smb.conf
语法检查： testparm [-v] [/etc/samba/smb.conf]
客户端工具：smbclient，pdnedit -L(列出Samba用户列表，读取passdb.tdb数据库文件)
三、搭建环境介绍
1.使用操作系统为RHEL8.0 2.Samba用户为三个(kitty,buer,alice），都可以浏览共享目录/share/,kitty和buer可以写入文件共享目录。 3.服务端hostname为control，客户端hostname为node1
四、Samba配置步骤
1.服务端操作
①在server端安装软件包
[root@control ~]# yum -y install samba samba-client
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Last metadata expiration check: 0:00:36 ago on Sun 02 May 2021 08:10:41 PM CST.
Dependencies resolved.
================================================================================================================================================
Package Arch Version Repository Size
================================================================================================================================================
Installing:
samba x86_64 4.9.1-8.el8 BaseOS 708 k
samba-client x86_64 4.9.1-8.el8 BaseOS 636 k
Installing dependencies:
samba-common-tools x86_64 4.9.1-8.el8 BaseOS 461 k
samba-libs x86_64 4.9.1-8.el8 BaseOS 177 k
Transaction Summary
================================================================================================================================================
Install 4 Packages
Total size: 1.9 M
Installed size: 5.6 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : samba-libs-4.9.1-8.el8.x86_64 1/4
Running scriptlet: samba-libs-4.9.1-8.el8.x86_64 1/4
Installing : samba-common-tools-4.9.1-8.el8.x86_64 2/4
Installing : samba-4.9.1-8.el8.x86_64 3/4
Running scriptlet: samba-4.9.1-8.el8.x86_64 3/4
Installing : samba-client-4.9.1-8.el8.x86_64 4/4
Running scriptlet: samba-client-4.9.1-8.el8.x86_64 4/4
Verifying : samba-4.9.1-8.el8.x86_64 1/4
Verifying : samba-client-4.9.1-8.el8.x86_64 2/4
Verifying : samba-common-tools-4.9.1-8.el8.x86_64 3/4
Verifying : samba-libs-4.9.1-8.el8.x86_64 4/4
Installed products updated.
Installed:
samba-4.9.1-8.el8.x86_64 samba-client-4.9.1-8.el8.x86_64 samba-common-tools-4.9.1-8.el8.x86_64 samba-libs-4.9.1-8.el8.x86_64
Complete!
②创建samba共享目录/share,设置权限，并拷贝文件到共享目录
[root@control ~]# mkdir /share
[root@control ~]# ll /share
total 0
[root@control ~]# ll -ld /share
drwxr-xr-x. 2 root root 6 May 2 20:24 /share
[root@control ~]# chmod 777 /share
[root@control ~]# ll -ld /share
drwxrwxrwx. 2 root root 6 May 2 20:24 /share
[root@control ~]# cp /etc/passwd /share
[root@control ~]# cp /etc/group /share
[root@control ~]# ls /share
group passwd
③创建samba用户
[root@control ~]# groupadd it
[root@control ~]# useradd -g it kitty
[root@control ~]# useradd alice
[root@control ~]# useradd buer
[root@control ~]# smbpasswd -a kitty
New SMB password:
Retype new SMB password:
Added user kitty.
[root@control ~]# smbpasswd -a alice
New SMB password:
Retype new SMB password:
Added user alice.
[root@control ~]# smbpasswd -a buer
New SMB password:
Retype new SMB password:
Added user buer.
#查看samba用户列表
[root@control ~]# pdbedit -L
kitty:2034:
buer:2036:
alice:2035:
④编辑samba主配置文件 进入配置目录/etc/samba/smb.conf
[share]
path = /share
browseable = yes
write list = @it,buer
hosts allow = 192.168.200.0/24
测试配置文件语法
[root@control ~]# testparm /etc/samba/smb.conf
Load smb config files from /etc/samba/smb.conf
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[homes]"
Processing section "[printers]"
Processing section "[print$]"
Processing section "[share]"
Loaded services file OK.
Server role: ROLE_STANDALONE
Press enter to see a dump of your service definitions
# Global parameters
[global]
printcap name = cups
security = USER
workgroup = SAMBA
idmap config * : backend = tdb
cups options = raw
[homes]
browseable = No
comment = Home Directories
inherit acls = Yes
read only = No
valid users = %S %D%w%S
[printers]
browseable = No
comment = All Printers
create mask = 0600
path = /var/tmp
printable = Yes
[print$]
comment = Printer Drivers
create mask = 0664
directory mask = 0775
force group = @printadmin
path = /var/lib/samba/drivers
write list = @printadmin root
[share]
hosts allow = 192.168.200.0/24
path = /share
write list = @it buer
⑤启动samba服务
[root@control ~]# systemctl start smb
[root@control ~]# systemctl start nmb
[root@control ~]# systemctl enable nmb
Created symlink /etc/systemd/system/multi-user.target.wants/nmb.service → /usr/lib/systemd/system/nmb.service.
[root@control ~]# systemctl enable smb
Created symlink /etc/systemd/system/multi-user.target.wants/smb.service → /usr/lib/systemd/system/smb.service.
⑥防火墙放行
[root@control ~]# firewall-cmd --permanent --add-service=samba
success
[root@control ~]# firewall-cmd --reload
success
⑦配置selinux安全标签
[root@control ~]# semanage fcontext -a -t samba_share_t '/share(/.*)?'
[root@control ~]# restorecon
restorecon restorecon_xattr
[root@control ~]# restorecon -vvFR /share
Relabeled /share from unconfined_u:object_r:default_t:s0 to system_u:object_r:samba_share_t:s0
Relabeled /share/passwd from unconfined_u:object_r:default_t:s0 to system_u:object_r:samba_share_t:s0
Relabeled /share/group from unconfined_u:object_r:default_t:s0 to system_u:object_r:samba_share_t:s0
2.在客户端操作
①客户端安装相关软件包
[root@node1 yum.repos.d]# yum -y install samba-client cifs-utils
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Repository AppStream is listed more than once in the configuration
Repository BaseOS is listed more than once in the configuration
AppStream 3.1 MB/s | 3.2 kB 00:00
BaseOS 2.7 MB/s | 2.7 kB 00:00
ansiable 0.0 B/s | 0 B 00:00
Failed to synchronize cache for repo 'ansiable', ignoring this repo.
Dependencies resolved.
================================================================================================================================================
Package Arch Version Repository Size
================================================================================================================================================
Installing:
cifs-utils x86_64 6.8-2.el8 BaseOS 93 k
samba-client x86_64 4.9.1-8.el8 BaseOS 636 k
Transaction Summary
================================================================================================================================================
Install 2 Packages
Total size: 729 k
Installed size: 2.3 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : samba-client-4.9.1-8.el8.x86_64 1/2
Running scriptlet: samba-client-4.9.1-8.el8.x86_64 1/2
Installing : cifs-utils-6.8-2.el8.x86_64 2/2
Running scriptlet: cifs-utils-6.8-2.el8.x86_64 2/2
Verifying : cifs-utils-6.8-2.el8.x86_64 1/2
Verifying : samba-client-4.9.1-8.el8.x86_64 2/2
Installed products updated.
Installed:
cifs-utils-6.8-2.el8.x86_64 samba-client-4.9.1-8.el8.x86_64
Complete!
②使用smbclient工具测试kitty和alice用户是否可以查看共享文件夹
[root@node1 yum.repos.d]# smbclient -L //192.168.200.150 -U kitty%redhat
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
share Disk
IPC$ IPC IPC Service (Samba 4.9.1)
kitty Disk Home Directories
Reconnecting with SMB1 for workgroup listing.
Server Comment
--------- -------
Workgroup Master
--------- -------
SAMBA CONTROL
[root@node1 yum.repos.d]# smbclient -L //192.168.200.150 -U alice%redhat
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
share Disk
IPC$ IPC IPC Service (Samba 4.9.1)
alice Disk Home Directories
Reconnecting with SMB1 for workgroup listing.
Server Comment
--------- -------
Workgroup Master
--------- -------
SAMBA CONTROL
③创建samba认证用户文件smbur，使用alice作为认证用户
[root@node1 yum.repos.d]# echo "username=alice" >> /etc/samba/smbur.txt
[root@node1 yum.repos.d]# echo "password=redhat" >> /etc/samba/smbur.txt
④编辑/etc/fstab文件，使挂载共享目录永久生效
[root@node1 yum.repos.d]# cat /etc/fstab
#
# /etc/fstab
# Created by anaconda on Fri Mar 19 22:21:55 2021
#
# Accessible filesystems, by reference, are maintained under '/dev/disk/'.
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info.
#
# After editing this file, run 'systemctl daemon-reload' to update systemd
# units generated from this file.
#
UUID=b7190d80-906f-4b9d-9ab4-5a503ecaea2c / xfs defaults 0 0
UUID=525a30a7-d484-4ed5-9f38-f827f54e29ff /boot xfs defaults 0 0
UUID=e6cf8733-5eec-4942-9429-c3e9087b6ff0 swap swap defaults 0 0
//192.168.200.150/share /media cifs defaults,credentials=/etc/samba/smbur.txt,multiuser,sec=ntlmssp 0 0
[root@node1 yum.repos.d]# df -h
Filesystem Size Used Avail Use% Mounted on
devtmpfs 970M 0 970M 0% /dev
tmpfs 984M 0 984M 0% /dev/shm
tmpfs 984M 9.1M 974M 1% /run
tmpfs 984M 0 984M 0% /sys/fs/cgroup
/dev/nvme0n1p3 18G 4.0G 14G 23% /
/dev/nvme0n1p1 495M 140M 356M 29% /boot
tmpfs 197M 4.0K 197M 1% /run/user/0
/dev/sr0 6.7G 6.7G 0 100% /mnt/cdrom
//192.168.200.150/share 13G 8.5G 4.1G 68% /media
五、测试用户的权限情况
1.检查在/media目录下以alice用户挂载权限
[root@node1 yum.repos.d]# cd /media/
[root@node1 media]# touch file1
touch: cannot touch 'file1': Permission denied
[root@node1 media]# ls
group passwd
2.切换本地admin用户，以kitty和buer这两个samba用户访问测试权限
[root@node1 yum.repos.d]# cd /media/
[root@node1 media]# touch file1
touch: cannot touch 'file1': Permission denied
[root@node1 media]# ls
group passwd
[root@node1 media]# useradd admin
[root@node1 media]# su - admin
[admin@node1 ~]$ cd /media
[admin@node1 media]$ cifscreds add -u kitty control
Password:
[admin@node1 media]$ ls
group passwd
[admin@node1 media]$ touch file1
[admin@node1 media]$ ls
file1 group passwd
[admin@node1 media]$ cifscreds update -u buer control
Password:
[admin@node1 media]$ ls
file1 group passwd
[admin@node1 media]$ touch file2
[admin@node1 media]$ ls
file1 file2 group passwd