CIFS文件系统

一、CIFS

  1.CIFS系统：Internet文件共享系统，也称服务器信；适用于MicrosoftWindows服务器和客户端的标准文件和打印机的共享系统息块（SMB）

  2.Samba服务：用于将linux文件系统作为CIFS/SMB网络文件进行共享，并将linux打印机作为CIFS/SMB打印机进行共享

 

二、Smb服务

 

 1.安装smb服务

  samba          ##服务端

  samba-common

  samba-client

 

 2.打开smb，列出共享文件系统信息

[root@server ~]#  systemctl start smb

[root@server ~]# smbclient -L //172.25.254.181

Enter root's password:

Anonymous login successful

Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]

 

Sharename       Type      Comment

---------       ----      -------

IPC$            IPC       IPC Service (Samba Server Version 4.1.1)

Anonymous login successful

Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]

 

Server               Comment

---------            -------

 

Workgroup            Master

---------            -------

 

vim /etc/vimrc

Vim /etc/samba/smb.conf

Systemctl restat service

 3.设置默认域名  [global]

 89         workgroup = WESTOS

 90         server string = Samba Server Version %v

 

 4.设置黑白名单  [global]

 96 ;       hosts allow = 172.25.254.77 172.25.254.177 

 97 ;       hosts deny  = 172.25.254.77 172.25.254. 177 

 

 5.设置用户登陆  ##注意：必须是本地用户

smbpasswd -a tom 添加tom用户

pdbedit -L  列出smb用户

pdbedit -x jerry 删除jerry用户

 

 

[root@server ~]# useradd tom

[root@server ~]# useradd jerry

[root@server ~]# smbpasswd -a tom  ##添加tom用户

New SMB password:

Retype new SMB password:

Added user tom.

[root@server ~]# smbpasswd -a jerry  ##添加jerry用户

New SMB password:

Retype new SMB password:

Added user jerry.

[root@server ~]# pdbedit -L   ##列出smb用户

tom:1001:

jerry:1002:

[root@server ~]# pdbedit -x jerry  ##删除jerry用户

[root@server ~]# pdbedit -L

tom:1001:

 

 6.使用用户登陆

[root@server ~]# smbclient -L //172.25.254.181 -U tom

Enter tom's password:                        ##按入Enter键

Anonymous login successful

Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]

 

Sharename       Type      Comment

---------       ----      -------

IPC$            IPC       IPC Service (Samba Server Version 4.1.1)

Anonymous login successful

Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]

 

Server               Comment

---------            -------

 

Workgroup            Master

---------            -------

 

 

三、Smb的Selinx保护

 

 当Selinux=Disable时

 

 1.进入用户家目录编辑

[root@client ~]# smbclient //172.25.254.181/tom -U tom  

Enter tom's password:

Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]

smb: \> ls  ##列出远程文件

  .                                   D        0  Thu May  3 21:46:28 2018

  ..                                  D        0  Thu May  3 21:46:34 2018

  .bash_profile                       H      193  Wed Jan 29 07:45:18 2014

  .mozilla                           DH        0  Thu Jul 10 18:29:32 2014

  .config                            DH        0  Thu Jul 10 19:06:52 2014

  .bashrc                             H      231  Wed Jan 29 07:45:18 2014

  .bash_logout                        H       18  Wed Jan 29 07:45:18 2014

 

smb: \> !ls  ##列出本地主机文件

anaconda-ks.cfg  Documents  Music     Public  Videos

Desktop  Downloads  Pictures  Templates

 

smb: \> put anaconda-ks.cfg  ##上传

putting file anaconda-ks.cfg as \anaconda-ks.cfg (8416.2 kb/s) (average 8417.0 kb/s)

 

smb: \> rm anaconda-ks.cfg  ##删除

 

smb: \> ?   ##列出smb可以使用的命令

?              allinfo        altname        archive        backup         

blocksize      cancel         case_sensitive cd             chmod          

chown          close          del            dir            du             

echo           exit           get            getfacl        geteas    

 

 

 2.挂载

[root@server ~]# mount -o username=tom,password=123 //172.25.254.181/tom /mnt

[root@server ~]# df

Filesystem           1K-blocks    Used Available Use% Mounted on

/dev/vda1             10473900 3155608   7318292  31% /

devtmpfs                469344       0    469344   0% /dev

tmpfs                   484932      84    484848   1% /dev/shm

tmpfs                   484932   12764    472168   3% /run

tmpfs                   484932       0    484932   0% /sys/fs/cgroup

//172.25.254.181/tom  10473900 3155608   7318292  31% /mnt

 

 

 3.设置开机自动挂载

[root@server ~]# vim /etc/fstab

//172.25.254.177/tom /mnt cifs defaults,username=tom,password=123 0 0

 

当Selinux=Enforing时  ##注意：smb处于开启状态

samba_enable_home_dirs  ##允许本地主目录作为CIFS文件共享

use_samba_home_dirs     ##允许挂载远程CIFS文件共享并将其用作本地主目录

samba_share_t           ##smb共享目录的selinux安全上下文

samba_export_all_ro     ##共享目录只读

samba_export_all_rw     ##允许共享目录读写

 

 1.进入用户家目录编辑

 

 

 2.修改sebool值，进入用户家目录编辑

[root@server ~]# smbclient //172.25.254.181/tom -U tom

Enter tom's password:

Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]

smb: \> ls

  .                                   D        0  Thu Jun  7 14:12:57 2018

  ..                                  D        0  Thu Jun  7 13:53:41 2018

  .bash_logout                        H       18  Wed Jan 29 20:45:18 2014

  .bash_profile                       H      193  Wed Jan 29 20:45:18 2014

  .bashrc                             H      231  Wed Jan 29 20:45:18 2014

  .mozilla                           DH        0  Fri Jul 11 06:29:32 2014

  .config                            DH        0  Fri Jul 11 07:06:52 2014

 

40913 blocks of size 262144. 28587 blocks available

 

 

 3.共享目录

 用户建立目录:

  修改配置文件，共享tets目录

[root@server ~]# mkdir /test

[root@server ~]# vim /etc/samba/smb.conf

322         [test]

323         comment = test directory

324         path    =/test

 

  重启smb，可以看到test目录共享信息

[root@server ~]# systemctl restart smb.service

[root@server ~]# smbclient -L //172.25.254.181/

Enter root's password:

Anonymous login successful

Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]

 

Sharename       Type      Comment

---------       ----      -------

test            Disk      test directory

IPC$            IPC       IPC Service (Samba Server Version 4.1.1)

Anonymous login successful

Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]

 

Server               Comment

---------            -------

 

Workgroup            Master

---------            -------

 

  但是，tom用户登陆无法编辑

 

  修改test目录的安全上下文，重启后再次登陆编辑

[root@server ~]# semanage fcontext -a -t samba_share_t '/test(/.*)?'

SELinux:  Could not downgrade policy file /etc/selinux/targeted/policy/policy.29, searching for an older version.

SELinux:  Could not open policy file <= /etc/selinux/targeted/policy/policy.29:  No such file or directory

/sbin/load_policy:  Can't load policy:  No such file or directory

libsemanage.semanage_reload_policy: load_policy returned error code 2.

SELinux:  Could not downgrade policy file /etc/selinux/targeted/policy/policy.29, searching for an older version.

SELinux:  Could not open policy file <= /etc/selinux/targeted/policy/policy.29:  No such file or directory

/sbin/load_policy:  Can't load policy:  No such file or directory

libsemanage.semanage_reload_policy: load_policy returned error code 2.

ValueError: Could not commit semanage transaction

[root@server ~]# restorecon -RvvF /test/

[root@server ~]# systemctl restart smb.service

[root@server ~]# smbclient  //172.25.254.181/test -U tom

Enter tom's password:

Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]

smb: \> ls

  .                                   D        0  Thu Jun  7 14:31:50 2018

  ..                                  D        0  Thu Jun  7 14:31:50 2018

 

40913 blocks of size 262144. 28586 blocks available

 

系统目录：

  修改配置文件，共享mnt系统目录

[root@server ~]# vim /etc/samba/smb.conf  

[mnt]

        comment = mnt test directory

        path    =/mnt

 

  重启后查看共享目录信息

[root@server ~]# systemctl restart smb.service

[root@server ~]# smbclient -L //172.25.254.181/

Enter root's password:

Anonymous login successful

Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]

 

Sharename       Type      Comment

---------       ----      -------

test            Disk      test directory

mnt             Disk      mnt test directory

IPC$            IPC       IPC Service (Samba Server Version 4.1.1)

Anonymous login successful

Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]

 

Server               Comment

---------            -------

 

Workgroup            Master

---------            -------

 

  设定samba的sebool值，打开所有共享目录的读写权限

[root@server ~]# setsebool samba_export_all_rw 1

setsebool:  SELinux is disabled.

 

[root@server ~]# smbclient  //172.25.254.181/mnt -U tom

Enter tom's password:

Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]

smb: \> ls

  .                                   D        0  Thu Jun  7 14:12:57 2018

  ..                                  D        0  Thu Jun  7 14:31:50 2018

  .bash_logout                        H       18  Wed Jan 29 20:45:18 2014

  .bash_profile                       H      193  Wed Jan 29 20:45:18 2014

  .bashrc                             H      231  Wed Jan 29 20:45:18 2014

  .mozilla                           DH        0  Fri Jul 11 06:29:32 2014

  .config                            DH        0  Fri Jul 11 07:06:52 2014

 

40913 blocks of size 262144. 28586 blocks available

 

 

四、多用户挂载

 

 1.指定用户具备读写权限  

[root@server ~]# vim /etc/samba/smb.conf

 

        [test]

        comment = test directory

        path    =/test

        write list =tom      ##只有tom用户具备权限

        ##writable = yes     ##所有用户具备权限

        ##write list =@tom   ##只有tom组的用户具备权限

 

 2.设定共享目录的读写权限，重启后测试

[root@server ~]# chmod 777 /test/

 

[root@server ~]# systemctl restart smb.service

 只有tom用户具备权限

[root@server ~]# mount //172.25.254.181/test /mnt -o username=tom,password=123

[root@server ~]# touch /mnt/file1

[root@server ~]# rm -rf /mnt/file1

 

 挂载jerry用户，不具备权限

[root@server ~]# umount /mnt

[root@server ~]# mount //172.25.254.181/test /mnt -o username=jerry,password=123

[root@server ~]# touch /mnt/file2

touch: cannot touch ‘/mnt/file2’: Permission denied

 

 

 3.用户相关权限设置

[root@server ~]# vim /etc/samba/smb.conf

[root@server ~]# systemctl restart smb.service

 

 

124         security = user

125         passdb backend = tdbsam

126         map to guest = bad user

 

        

map to guest = bad user  ##匿名用户映射为guest

browseable = no    ##不显示test共享目录,但可以正常使用

admin users =student  ##studet用户编辑时以root用户身份

        [test]

        comment = test directory

        path    =/test

        writeable = yes

        browseable = no    ##不显示test共享目录

        guest ok = yes     ##允许匿名用户登陆

        admin users =student  ##studet用户编辑时以root用户身份

 

 匿名用户登陆

[root@server ~]# mount -o username=guest //172.25.254.181/test /mnt

[root@server ~]# df

Filesystem            1K-blocks    Used Available Use% Mounted on

/dev/vda1              10473900 3155680   7318220  31% /

devtmpfs                 469344       0    469344   0% /dev

tmpfs                    484932      84    484848   1% /dev/shm

tmpfs                    484932   12764    472168   3% /run

tmpfs                    484932       0    484932   0% /sys/fs/cgroup

//172.25.254.181/test  10473900 3155680   7318220  31% /mnt

 

 

 

 不显示test共享目录，但是不影响使用

[root@server ~]# smbclient -L //172.25.254.181

Enter root's password:

Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]

 

Sharename       Type      Comment

---------       ----      -------

mnt             Disk      mnt test directory

IPC$            IPC       IPC Service (Samba Server Version 4.1.1)

Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]

 

Server               Comment

---------            -------

 

Workgroup            Master

---------            -------

 

 以student身份挂载，建立文件

[root@server ~]# mount //172.25.254.181/test /mnt -o username=student,password=123

[root@server ~]# touch /mnt/fire00

[root@server ~]# ll /mnt

total 0

-rw-r--r-- 1 nobody nobody 0 6月   7 15:52 fire00

 

 4.实现多用户挂载

 安装 cifs-utils 软件

[root@server ~]# yum install cifs-utils -y

 配置用户文件 vim /root/samba

  1 username=tom

  2 passwird=123

 

[root@server ~]# man mount.cifs

[root@server ~]# vim /root/samba

[root@server ~]# cat /root/samba

username=tom

passwird=123

 

 

 查看帮助 man mount.cifs

 多用户挂载

[root@server ~]# mount -o credentials=/root/samba,sec=ntlmssp,multiuer //172.25.254.177/test /mnt

 此时root用户

[root@server ~]# cd /mnt/

[root@server mnt]# ls

file  file123  filetest

[root@foundation8 mnt]# rm -fr file123

rm: cannot remove ‘file123’: Permission denied

[root@foundation8 mnt]# touch test

touch: cannot touch ‘test’: Permission denied

 

 而普通用户

[kiosk@foundation8 yum.repos.d]$ cd /mnt

[kiosk@foundation8 mnt]$ ls

ls: reading directory .: Permission denied

 

 普通用户认证  ##跟/test权限有关

[kiosk@foundation8 mnt]$ cifscreds add -u tom 172.25.254.181

Password:

[kiosk@foundation8 mnt]$ ls

file  file123  filetest

[kiosk@foundation8 mnt]$ rm -fr file

rm: cannot remove ‘file’: Permission denied