Linux下的samba服务配置详解

一、Samba介绍

1.1 Samba简介

1.SMB（Server Messages Block，信息服务块）是一种在局域网上共享文件和打印机的一种通信协议，它为局域网内的不同计算机之间提供文件及打印机等资源的共享服务。
2.Samba是在Linux和UNIX系统上实现SMB协议的一个免费软件，由服务器及客户端程序构成。

1.2 CIFS和NFS简介

1.CIFS：common internet file system，微软基于SMB发布。
2.NFS:网络文件系统，英文Network File System(NFS)，是由SUN公司研制的UNIX表示层协议(presentation layer protocol)，能使使用者访问网络上别处的文件就像在使用自己的计算机一样。

二、Samba工具及特性

2.1 Samba相关包

①samba 提供smb服务
②samba-client 客户端软件
③samba-common 通用软件
④cifs-utils smb客户端工具
⑤samba-winbind 和AD相关

2.2 Samba相关服务进程

smbd 提供smb（cifs）服务 TCP:139,445
nmbd NetBIOS名称解析 UDP:137,138

2.3 相关工具及命令

• 主配置文件：

/etc/samba/smb.conf 

• 语法检查：

 testparm  [-v]  [/etc/samba/smb.conf]

• 客户端工具：s

mbclient，pdbedit -L(列出Samba用户列表，读取passdb.tdb数据库文件)

三、搭建环境介绍

1.使用操作系统为RHEL8.0
2.Samba用户为三个(kitty,buer,alice），都可以浏览共享目录/share/,kitty和buer可以写入文件共享目录。
3.服务端hostname为control，客户端hostname为node1

四、Samba配置步骤

4.1 服务端操作

①在server端安装软件包

[root@control ~]# yum -y install samba samba-client
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Last metadata expiration check: 0:00:36 ago on Sun 02 May 2021 08:10:41 PM CST.
Dependencies resolved.
================================================================================================================================================
 Package                                   Arch                          Version                            Repository                     Size
================================================================================================================================================
Installing:
 samba                                     x86_64                        4.9.1-8.el8                        BaseOS                        708 k
 samba-client                              x86_64                        4.9.1-8.el8                        BaseOS                        636 k
Installing dependencies:
 samba-common-tools                        x86_64                        4.9.1-8.el8                        BaseOS                        461 k
 samba-libs                                x86_64                        4.9.1-8.el8                        BaseOS                        177 k

Transaction Summary
================================================================================================================================================
Install  4 Packages

Total size: 1.9 M
Installed size: 5.6 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                                        1/1 
  Installing       : samba-libs-4.9.1-8.el8.x86_64                                                                                          1/4 
  Running scriptlet: samba-libs-4.9.1-8.el8.x86_64                                                                                          1/4 
  Installing       : samba-common-tools-4.9.1-8.el8.x86_64                                                                                  2/4 
  Installing       : samba-4.9.1-8.el8.x86_64                                                                                               3/4 
  Running scriptlet: samba-4.9.1-8.el8.x86_64                                                                                               3/4 
  Installing       : samba-client-4.9.1-8.el8.x86_64                                                                                        4/4 
  Running scriptlet: samba-client-4.9.1-8.el8.x86_64                                                                                        4/4 
  Verifying        : samba-4.9.1-8.el8.x86_64                                                                                               1/4 
  Verifying        : samba-client-4.9.1-8.el8.x86_64                                                                                        2/4 
  Verifying        : samba-common-tools-4.9.1-8.el8.x86_64                                                                                  3/4 
  Verifying        : samba-libs-4.9.1-8.el8.x86_64                                                                                          4/4 
Installed products updated.

Installed:
  samba-4.9.1-8.el8.x86_64     samba-client-4.9.1-8.el8.x86_64     samba-common-tools-4.9.1-8.el8.x86_64     samba-libs-4.9.1-8.el8.x86_64    

Complete!

②创建samba共享目录/share,设置权限，并拷贝文件到共享目录

[root@control ~]# mkdir /share
[root@control ~]# ll /share
total 0
[root@control ~]# ll -ld /share
drwxr-xr-x. 2 root root 6 May  2 20:24 /share
[root@control ~]# chmod 777 /share
[root@control ~]# ll -ld /share
drwxrwxrwx. 2 root root 6 May  2 20:24 /share

[root@control ~]# cp /etc/passwd /share
[root@control ~]# cp /etc/group /share
[root@control ~]# ls /share
group  passwd

③创建samba用户

[root@control ~]# groupadd it
[root@control ~]# useradd -g it kitty
[root@control ~]# useradd alice
[root@control ~]# useradd buer
[root@control ~]# smbpasswd -a kitty
New SMB password:
Retype new SMB password:
Added user kitty.
[root@control ~]# smbpasswd -a alice
New SMB password:
Retype new SMB password:
Added user alice.
[root@control ~]# smbpasswd -a buer
New SMB password:
Retype new SMB password:
Added user buer.

#查看samba用户列表
[root@control ~]# pdbedit -L
kitty:2034:
buer:2036:
alice:2035:

④编辑samba主配置文件
进入配置目录/etc/samba/smb.conf

[share]
      path = /share
      browseable = yes
      write list = @it,buer
      hosts allow = 192.168.200.0/24

测试配置文件语法

[root@control ~]# testparm /etc/samba/smb.conf
Load smb config files from /etc/samba/smb.conf
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[homes]"
Processing section "[printers]"
Processing section "[print$]"
Processing section "[share]"
Loaded services file OK.
Server role: ROLE_STANDALONE

Press enter to see a dump of your service definitions

# Global parameters
[global]
	printcap name = cups
	security = USER
	workgroup = SAMBA
	idmap config * : backend = tdb
	cups options = raw


[homes]
	browseable = No
	comment = Home Directories
	inherit acls = Yes
	read only = No
	valid users = %S %D%w%S


[printers]
	browseable = No
	comment = All Printers
	create mask = 0600
	path = /var/tmp
	printable = Yes


[print$]
	comment = Printer Drivers
	create mask = 0664
	directory mask = 0775
	force group = @printadmin
	path = /var/lib/samba/drivers
	write list = @printadmin root


[share]
	hosts allow = 192.168.200.0/24
	path = /share
	write list = @it buer

⑤启动samba服务

[root@control ~]# systemctl start smb
[root@control ~]# systemctl start nmb
[root@control ~]# systemctl enable nmb
Created symlink /etc/systemd/system/multi-user.target.wants/nmb.service → /usr/lib/systemd/system/nmb.service.
[root@control ~]# systemctl enable smb
Created symlink /etc/systemd/system/multi-user.target.wants/smb.service → /usr/lib/systemd/system/smb.service.

⑥防火墙放行服务

[root@control ~]# firewall-cmd --permanent --add-service=samba
success
[root@control ~]# firewall-cmd --reload 
success

⑦配置selinux安全标签

[root@control ~]# semanage fcontext -a -t samba_share_t '/share(/.*)?'
[root@control ~]# restorecon
restorecon        restorecon_xattr  
[root@control ~]# restorecon -vvFR /share
Relabeled /share from unconfined_u:object_r:default_t:s0 to system_u:object_r:samba_share_t:s0
Relabeled /share/passwd from unconfined_u:object_r:default_t:s0 to system_u:object_r:samba_share_t:s0
Relabeled /share/group from unconfined_u:object_r:default_t:s0 to system_u:object_r:samba_share_t:s0

4.2 在客户端操作

①客户端安装相关软件包

[root@node1 yum.repos.d]# yum -y install samba-client cifs-utils
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Repository AppStream is listed more than once in the configuration
Repository BaseOS is listed more than once in the configuration
AppStream                                                                                                       3.1 MB/s | 3.2 kB     00:00    
BaseOS                                                                                                          2.7 MB/s | 2.7 kB     00:00    
ansiable                                                                                                        0.0  B/s |   0  B     00:00    
Failed to synchronize cache for repo 'ansiable', ignoring this repo.
Dependencies resolved.
================================================================================================================================================
 Package                              Arch                           Version                               Repository                      Size
================================================================================================================================================
Installing:
 cifs-utils                           x86_64                         6.8-2.el8                             BaseOS                          93 k
 samba-client                         x86_64                         4.9.1-8.el8                           BaseOS                         636 k

Transaction Summary
================================================================================================================================================
Install  2 Packages

Total size: 729 k
Installed size: 2.3 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                                        1/1 
  Installing       : samba-client-4.9.1-8.el8.x86_64                                                                                        1/2 
  Running scriptlet: samba-client-4.9.1-8.el8.x86_64                                                                                        1/2 
  Installing       : cifs-utils-6.8-2.el8.x86_64                                                                                            2/2 
  Running scriptlet: cifs-utils-6.8-2.el8.x86_64                                                                                            2/2 
  Verifying        : cifs-utils-6.8-2.el8.x86_64                                                                                            1/2 
  Verifying        : samba-client-4.9.1-8.el8.x86_64                                                                                        2/2 
Installed products updated.

Installed:
  cifs-utils-6.8-2.el8.x86_64                                          samba-client-4.9.1-8.el8.x86_64                                         

Complete!

②使用smbclient工具测试kitty和alice用户是否可以查看共享文件夹

[root@node1 yum.repos.d]# smbclient -L //192.168.200.150 -U kitty%redhat

	Sharename       Type      Comment
	---------       ----      -------
	print$          Disk      Printer Drivers
	share           Disk      
	IPC$            IPC       IPC Service (Samba 4.9.1)
	kitty           Disk      Home Directories
Reconnecting with SMB1 for workgroup listing.

	Server               Comment
	---------            -------

	Workgroup            Master
	---------            -------
	SAMBA                CONTROL
[root@node1 yum.repos.d]# smbclient -L //192.168.200.150 -U alice%redhat

	Sharename       Type      Comment
	---------       ----      -------
	print$          Disk      Printer Drivers
	share           Disk      
	IPC$            IPC       IPC Service (Samba 4.9.1)
	alice           Disk      Home Directories
Reconnecting with SMB1 for workgroup listing.

	Server               Comment
	---------            -------

	Workgroup            Master
	---------            -------
	SAMBA                CONTROL

③创建samba认证用户文件smbur，使用alice作为认证用户

[root@node1 yum.repos.d]# echo "username=alice" >> /etc/samba/smbur.txt
[root@node1 yum.repos.d]# echo "password=redhat" >> /etc/samba/smbur.txt

④编辑/etc/fstab文件，使挂载共享目录永久生效

[root@node1 yum.repos.d]# cat /etc/fstab 

#
# /etc/fstab
# Created by anaconda on Fri Mar 19 22:21:55 2021
#
# Accessible filesystems, by reference, are maintained under '/dev/disk/'.
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info.
#
# After editing this file, run 'systemctl daemon-reload' to update systemd
# units generated from this file.
#
UUID=b7190d80-906f-4b9d-9ab4-5a503ecaea2c /                       xfs     defaults        0 0
UUID=525a30a7-d484-4ed5-9f38-f827f54e29ff /boot                   xfs     defaults        0 0
UUID=e6cf8733-5eec-4942-9429-c3e9087b6ff0 swap                    swap    defaults        0 0


//192.168.200.150/share /media cifs defaults,credentials=/etc/samba/smbur.txt,multiuser,sec=ntlmssp 0 0
[root@node1 yum.repos.d]# df -h
Filesystem               Size  Used Avail Use% Mounted on
devtmpfs                 970M     0  970M   0% /dev
tmpfs                    984M     0  984M   0% /dev/shm
tmpfs                    984M  9.1M  974M   1% /run
tmpfs                    984M     0  984M   0% /sys/fs/cgroup
/dev/nvme0n1p3            18G  4.0G   14G  23% /
/dev/nvme0n1p1           495M  140M  356M  29% /boot
tmpfs                    197M  4.0K  197M   1% /run/user/0
/dev/sr0                 6.7G  6.7G     0 100% /mnt/cdrom
//192.168.200.150/share   13G  8.5G  4.1G  68% /media

五、测试用户的权限情况

5.1 检查用户挂载权限

检查在/media目录下以alice用户挂载权限

[root@node1 yum.repos.d]# cd /media/
[root@node1 media]# touch file1
touch: cannot touch 'file1': Permission denied
[root@node1 media]# ls
group  passwd

5.2 切换本地admin用户

切换本地admin用户，以kitty和buer这两个samba用户访问测试权限

[root@node1 yum.repos.d]# cd /media/
[root@node1 media]# touch file1
touch: cannot touch 'file1': Permission denied
[root@node1 media]# ls
group  passwd
[root@node1 media]# useradd admin
[root@node1 media]# su - admin
[admin@node1 ~]$ cd /media
[admin@node1 media]$ cifscreds add -u kitty control
Password: 
[admin@node1 media]$ ls
group  passwd
[admin@node1 media]$ touch file1
[admin@node1 media]$ ls
file1  group  passwd
[admin@node1 media]$ cifscreds update  -u buer control
Password: 
[admin@node1 media]$ ls
file1  group  passwd
[admin@node1 media]$ touch file2
[admin@node1 media]$ ls
file1  file2  group  passwd