一.SAMBA
1.windows系统共享文件时候用的协议是smb
[root@server8 ~]# dnf install samba.x86_64 samba-common.noarch samba-client -y
安装samba
[root@server8 ~]# smbpasswd -a chihao
New SMB password:
Retype new SMB password:
Added user chihao.
[root@server8 ~]# smbpasswd -a yiyi
New SMB password:
Retype new SMB password:
Added user yiyi.
给samba服务添加用户，必须是本机用户
[root@server8 ~]# pdbedit -L
chihao:1000:chihao
yiyi:1001:
此命令可以查看添加的samba用户
[root@server8 ~]# pdbedit -x yiyi
[root@server8 ~]# pdbedit -L
chihao:1000:chihao
删除samba用户
[root@server8 ~]# systemctl enable --now smb.service
Created symlink /etc/systemd/system/multi-user.target.wants/smb.service → /usr/lib/systemd/system/smb.service.
[root@server8 ~]# firewall-cmd --permanent --add-service=samba
success
[root@server8 ~]# firewall-cmd --reload
success
启用samba服务并且在火墙中设置好
selinux一般会阻止samba用户访问自己的家目录
[root@server8 ~]# getsebool -a |grep samba
samba_create_home_dirs --> off
samba_domain_controller --> off
samba_enable_home_dirs --> off
samba_export_all_ro --> off
samba_export_all_rw --> off
samba_load_libgfapi --> off
samba_portmapper --> off
samba_run_unconfined --> off
samba_share_fusefs --> off
samba_share_nfs --> off
sanlock_use_samba --> off
tmpreaper_use_samba --> off
use_samba_home_dirs --> off
virt_use_samba --> off
更改selinux的设置
setsebool -P samba_enable_home_dirs on
尝试访问自己的家目录
smbclient //172.25.254.244/chihao -U chihao
家目录的名称和用户名是一致的
2.利用samba共享一个自己的目录
[root@server8 ~]# mkdir /haoge
[root@server8 ~]# cd /haoge/
[root@server8 haoge]# touch file{1..10}
在根下建立一个测试目录
[root@server8 /]# cd /etc/samba/
[root@server8 samba]# ls
lmhosts smb.conf smb.conf.example
[root@server8 samba]# mv smb.conf smb.conf.bak
[root@server8 samba]# mv smb.conf.example smb.conf
[root@server8 samba]# ls
lmhosts smb.conf smb.conf.bak
samba的配置文件内容比较少，但是例子文件里很全，建议可以把主配置文件改名，然后把例子文件改称配置文件
[root@server8 samba]# semanage fcontext -a -t samba_share_t '/haoge(/.*)?'
[root@server8 samba]# restorecon -RvvF /haoge/
更改测试文件的安全上下文
下一步更改配置文件：
[root@server8 ~]# systemctl restart smb.service
重启服务
[root@server8 ~]# smbclient -L //172.25.254.244 -U chihao
Enter MYGROUP\chihao's password:
Sharename Type Comment
--------- ---- -------
HAOGE Disk local dir haoge
IPC$ IPC IPC Service (Samba Server Version 4.11.2)
chihao Disk Home Directories
SMB1 disabled -- no workgroup available
可以看到这个文件已经共享，-L是列出的意思
[root@server8 ~]# smbclient //172.25.254.244/HAOGE -U chihao
Enter MYGROUP\chihao's password:
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Tue Apr 27 10:51:05 2021
.. D 0 Tue Apr 27 10:50:50 2021
file1 N 0 Tue Apr 27 10:51:05 2021
file2 N 0 Tue Apr 27 10:51:05 2021
file3 N 0 Tue Apr 27 10:51:05 2021
file4 N 0 Tue Apr 27 10:51:05 2021
file5 N 0 Tue Apr 27 10:51:05 2021
file6 N 0 Tue Apr 27 10:51:05 2021
file7 N 0 Tue Apr 27 10:51:05 2021
file8 N 0 Tue Apr 27 10:51:05 2021
file9 N 0 Tue Apr 27 10:51:05 2021
file10 N 0 Tue Apr 27 10:51:05 2021
13092864 blocks of size 1024. 8214564 blocks available
并且可以使用
3.共享一个系统级别的目录
root@server8 ~]# getsebool -a |grep samba
samba_create_home_dirs --> off
samba_domain_controller --> off
samba_enable_home_dirs --> on
samba_export_all_ro --> off
samba_export_all_rw --> off
samba_load_libgfapi --> off
samba_portmapper --> off
samba_run_unconfined --> off
samba_share_fusefs --> off
samba_share_nfs --> off
sanlock_use_samba --> off
tmpreaper_use_samba --> off
use_samba_home_dirs --> off
virt_use_samba --> off
[root@server8 ~]# setsebool -P samba_export_all_ro on
更改这一条，让samba不再受到selinux安全上下文的限制
[root@server8 ~]# smbclient //172.25.254.244/MNT -U chihao
Enter MYGROUP\chihao's password:
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Mon Apr 26 21:20:00 2021
.. D 0 Tue Apr 27 10:50:50 2021
testdir1 D 0 Mon Apr 26 21:40:59 2021
13092864 blocks of size 1024. 8241652 blocks available
smb: \>
可以访问mnt
4.samba的访问控制
客户端也安装 samba
[root@client8 ~]# smbclient -L //172.25.254.244 -U chihao
Enter SAMBA\chihao's password:
Sharename Type Comment
--------- ---- -------
HAOGE Disk local dir haoge
MNT Disk /mnt dir
IPC$ IPC IPC Service (Samba Server Version 4.11.2)
chihao Disk Home Directories
SMB1 disabled -- no workgroup available
也可以访问
[root@client8 ~]# mount -o username=chihao,password=chihao //172.25.254.244/HAOGE /mnt
[root@client8 ~]# df
Filesystem 1K-blocks Used Available Use% Mounted on
devtmpfs 906280 0 906280 0% /dev
tmpfs 935304 0 935304 0% /dev/shm
tmpfs 935304 17968 917336 2% /run
tmpfs 935304 0 935304 0% /sys/fs/cgroup
/dev/mapper/rhel-root 13092864 5077260 8015604 39% /
/dev/vda1 1038336 233980 804356 23% /boot
tmpfs 187060 1180 185880 1% /run/user/42
tmpfs 187060 36 187024 1% /run/user/0
//172.25.254.244/HAOGE 13092864 4850688 8242176 38% /mnt
把服务端的测试目录挂载到客户端上
[root@westos Desktop]# mount -o username=chihao,password=chihao //172.25.254.244/HAOGE /mnt/
[root@westos Desktop]# df
Filesystem 1K-blocks Used Available Use% Mounted on
devtmpfs 7769044 0 7769044 0% /dev
tmpfs 7796688 98636 7698052 2% /dev/shm
tmpfs 7796688 75952 7720736 1% /run
tmpfs 7796688 0 7796688 0% /sys/fs/cgroup
/dev/nvme0n1p8 95818024 68316016 27502008 72% /
/dev/nvme0n1p6 1038336 224332 814004 22% /boot
/dev/nvme0n1p1 262144 35956 226188 14% /boot/efi
tmpfs 1559336 20 1559316 1% /run/user/42
tmpfs 1559336 44 1559292 1% /run/user/1000
/dev/loop0 8238560 8238560 0 100% /var/www/html/rhel8.2
//172.25.254.244/HAOGE 13092864 4850612 8242252 38% /mnt
真实主机也可以挂载
[root@server8 ~]# vim /etc/samba/smb.conf
设置白名单，只有144可以访问
查看效果
[root@westos Desktop]# mount -o username=chihao,password=chihao //172.25.254.244/HAOGE /mnt/
mount: /mnt: special device //172.25.254.244/HAOGE does not exist.
144可以正常挂载，其他用户被拒绝
黑名单如图，只拒绝144
写在这里意思是只有这个文件有权限
[root@westos Desktop]# mount -o username=chihao,password=chihao //172.25.254.244/HAOGE /mnt/
mount: /mnt: cannot mount //172.25.254.244/HAOGE read-only.
[root@westos Desktop]# mount -o username=chihao,password=chihao //172.25.254.244/MNT /mnt/
[root@westos Desktop]# df
Filesystem 1K-blocks Used Available Use% Mounted on
devtmpfs 7769044 0 7769044 0% /dev
tmpfs 7796688 101220 7695468 2% /dev/shm
tmpfs 7796688 75952 7720736 1% /run
tmpfs 7796688 0 7796688 0% /sys/fs/cgroup
/dev/nvme0n1p8 95818024 68314992 27503032 72% /
/dev/nvme0n1p6 1038336 224332 814004 22% /boot
/dev/nvme0n1p1 262144 35956 226188 14% /boot/efi
tmpfs 1559336 20 1559316 1% /run/user/42
tmpfs 1559336 44 1559292 1% /run/user/1000
/dev/loop0 8238560 8238560 0 100% /var/www/html/rhel8.2
//172.25.254.244/MNT 13092864 4850648 8242216 38% /mnt
除了haoge其他都可以正常访问
(2)基于用户的访问控制
指定只能yiyi用户访问
[root@server8 ~]# mount -o username=chihao,password=chihao //172.25.254.244/HAOGE /mnt
mount: /mnt: cannot mount //172.25.254.244/HAOGE read-only.
chihao用户不能访问
[root@server8 ~]# mount -o username=yiyi,password=chihao //172.25.254.244/HAOGE /mnt
[root@server8 ~]# df
Filesystem 1K-blocks Used Available Use% Mounted on
devtmpfs 906280 0 906280 0% /dev
tmpfs 935304 0 935304 0% /dev/shm
tmpfs 935304 17956 917348 2% /run
tmpfs 935304 0 935304 0% /sys/fs/cgroup
/dev/mapper/rhel-root 13092864 4850648 8242216 38% /
/dev/vda1 1038336 233980 804356 23% /boot
tmpfs 187060 1180 185880 1% /run/user/42
tmpfs 187060 4660 182400 3% /run/user/0
//172.25.254.244/HAOGE 13092864 4850648 8242216 38% /mnt
yiyi用户可以正常访问
+和@意思就是只有这个组的用户可以访问
5.samba中的常用参数
[root@server8 ~]# chmod 777 /haoge/
给测试目录一个满权限，这样任何人都可写
[root@client8 ~]# mount -o username=chihao,password=chihao //172.25.254.244/HAOGE /mnt
[root@client8 ~]# ls /mnt/
file1 file10 file2 file3 file4 file5 file6 file7 file8 file9
[root@client8 ~]# cd /mnt/
[root@client8 mnt]# touch hehe
touch: cannot touch 'hehe': Permission denied
客户端测试，还是被拒绝
[root@server8 ~]# vim /etc/samba/smb.conf
[root@server8 ~]# systemctl restart smb.service
t添加参数再尝试
[root@client8 mnt]# touch hehe
[root@client8 mnt]# ls
file1 file10 file2 file3 file4 file5 file6 file7 file8 file9 hehe
任何用户都可以在这个测试目录可写
指定用户或组可写
[root@client8 ~]# mount -o username=yiyi,password=chihao //172.25.254.244/HAOGE /mnt
[root@client8 ~]# cd /mnt/
[root@client8 mnt]# ls
file1 file10 file2 file3 file4 file5 file6 file7 file8 file9 hehe
[root@client8 mnt]# touch he
[root@client8 mnt]# ls
file1 file10 file2 file3 file4 file5 file6 file7 file8 file9 he hehe
组的话加+或者@
browseable = no
默认是yes，如果改称no相当于把此目录隐藏起来
guest ok = yes
匿名用户可以访问
设置以后不需要输入密码就能访问
map to guest一定要在global全局添加
6.samba客户端的多用户挂载
客户端有普通用户和超级用户
[root@client8 ~]# dnf install cifs-utils -y
客户端安装此软件，samba安全认证插件
[root@client8 ~]# vim /root/smb_auth
[root@client8 ~]# chmod 600 /root/smb_auth
创建一个超级用户所使用的认证文件，给予权限只超级用户可以使用
[root@client8 ~]# cat /root/smb_auth
username=chihao
password=chihao
[root@client8 ~]# mount //172.25.254.244/HAOGE /mnt/ -o credentials=/root/smb_auth,multiuser,sec=ntlmssp
[root@client8 ~]# cd /mnt/
[root@client8 mnt]# ls
file1 file10 file2 file3 file4 file5 file6 file7 file8 file9 he hehe
[root@client8 mnt]# su - chihao
[chihao@client8 ~]$ cd /mnt
[chihao@client8 mnt]$ ls
ls: cannot open directory '.': Permission denied
按照这个方式进行挂载，只有认证文件中的用户才能查看挂载的内容，其他的用户被拒绝
其他用户想登录必须要有自己的认证
[chihao@client8 mnt]$ cifscreds add -u yiyi 172.25.254.244
Password:
[chihao@client8 mnt]$ ls
file1 file10 file2 file3 file4 file5 file6 file7 file8 file9 he hehe
其他用户借yiyi这个认证登录，也可以查看挂载的内容
出问题就用clear清除重新认证。
263
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
