CentOS远程操作Windows端授权(使用AD域)
请先确保CentOS机器可连接到对应Windows机器(可ping通)
请先确保Windows机器已加入AD域,且有set_acl.ps1赋权脚本
请先确保三台机器均在一个vpn下/局域网下,且两台windows均已挂载网络映射盘
环境
WindowsA (已加入AD域)
ip | 192.168.50.229 |
---|---|
userName | testyzr |
hostName | CN_LAP119 |
WindowsB (本地)
ip | 192.168.50.224 |
---|---|
userName | ssikme |
WindowsC (AD域)
ip | 192.168.40.123 |
---|---|
userName | admin-ad |
hostName | pbstest.com |
需求
在WindowsA,WindowsB已挂载Nas网络映射盘,其中WindowsA是通过有管理员权限的账户挂载的,WindowsB是普通用户挂载。现需要在WindowsB的Nas盘上建立新文件夹,用户PBSTEST/ljh有权限在此新文件夹下操作
执行步骤
1、在WindowsB下的挂载盘里创建新文件夹
2、在WindowsA/WindowsB查看文件夹权限
属性-->安全-->组或用户名查看
3、在CentOS内操作
(1)准备脚本test4.ps1
$net = new-object -ComObject WScript.Network
# 填你的映射盘地址,我这里是挂载到Y盘,后面填入你的域管理员账号和密码
$net.MapNetworkDrive( "Y:", "\\192.168.40.194\nas\sdm", $false, "PBSTEST\admin-ad", "password@3#" )
# 在WindowsA的赋权脚本path
$script2 = "D:\set_acl.ps1"
# 将PBSTEST\ljh账号加到Y:\testyzr7路径下,并赋权“Read,ReadData,ReadAndExecute”
& $script2 -Folder "Y:\testyzr7" -User "PBSTEST\ljh" -Rights "Read", "ReadData", "ReadAndExecute" -Flags "Allow"
(2)准备脚本test20240618.ps1
# 此脚本用于登录到windowsA系统里,需要填入管理员账号和密码
$account = "testyzr"
$password = "test12345"
$secpwd = convertto-securestring $password -asplaintext -force
$cred = new-object System.Management.Automation.PSCredential -argumentlist $account,$secpwd
# 通过以上凭证直接远程到WindowsA机器上运行test4.ps1脚本
Invoke-Command -ComputerName "192.168.50.229" -Authentication Negotiate -Credential $cred -FilePath /home/yzr/test4.ps1
(3)准备java脚本
//package com.yzr;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
public class ExecuteCommand {
public static void main(String[] args) {
try {
String scriptPath = "/home/yzr/test20240618.ps1";
ProcessBuilder pb = new ProcessBuilder("pwsh", scriptPath);
Process process = pb.start();
print(process.getInputStream());
process.waitFor();
} catch (Exception e) {
e.printStackTrace();
return;
}
}
public static void print(InputStream inputStream){
try {
BufferedReader reader = new BufferedReader(new InputStreamReader(inputStream));
String line;
while ((line = reader.readLine()) != null) {
System.out.println(line);
}
reader.close();
}catch (Exception e){
e.printStackTrace();
System.out.println("出现异常..");
}
}
}
(4)运行Java脚本,查看是否已赋权
[yzr@localhost ~]$ java ExecuteCommand
(5)在WindowsA/WindowsB上查看权限
如图,已将PBSTEST\ljh
赋权到文件夹testyzr7
上
(6)进阶-并发测试java脚本(test.sh)
#!/bin/bash
echo "start..."
for((i=0;i<30;i++)); do
# 这里的 & 会开启一个子进程执行
{
echo "start........."$i;
java ExecuteCommand;
echo "--------------------------------------done"$i
} &
done
# 使用 wait 命令阻塞当前进程,直到所有子进程全部执行完
wait
echo "you have download all files"
4、其他
(1)WindowsA下的授权脚本
位置:D:\set_acl.ps1
param (
[Parameter(Mandatory=$true)]
[string]$Folder,
[Parameter(Mandatory=$true)]
[string]$User,
[Parameter(Mandatory=$true)]
[string[]]$Rights,
[Parameter(Mandatory=$true)]
[string]$Flags
)
$InheritType = "ContainerInherit,ObjectInherit"
$AccessRights = [System.Security.AccessControl.FileSystemRights]$Rights
$AccessControlType = [System.Security.AccessControl.AccessControlType]$Flags
$tmpAR = New-Object System.Security.AccessControl.FileSystemAccessRule($User, $AccessRights, $InheritType, "None", $AccessControlType)
$rule = New-Object 'security.accesscontrol.filesystemaccessrule'("CREATOR OWNER",@("ReadAndExecute,Synchronize"),"ContainerInherit,Objectinherit","Inheritonly","Allow")
#.\set_acl.ps1 -Folder "E:\test" -User "PBSTEST\zhry" -Rights "ReadAndExecute" -Flags "Allow"
Write-Host "$Folder"
Write-Host "$User"
Write-Host "$Rights"
Write-Host "$Flags"
Write-Host "Hello, $tmpAR!"
Write-Host "111,$InheritType,$AccessRights,$AccessControlType"
Write-Host "Hello, $rule!"
# Add ACL to this folder
$Acl = Get-ACL -Path $Folder -Audit
$Acl.AddAccessRule($tmpAR)
Set-ACL -Path $Folder -AclObject $Acl