Linux网络服务_cifs文件系统

cifs文件系统

一.简单介绍

cifs普通网络文件系统—>用于类linux与windows之间的文件共享
可变成本机的存储，实现文件的挂载
用于将文件和主机分离，将信息存储在独立的不对外开放的主机中
cifs—>windows
nfs—>linux/unix

【实验准备】

1).准备好两台主机server（服务端）和desktop（客户端）

2).设置IP(route -n与ifconfig检测)，主机名，配置yum源

3).检测yum源

[root@desktop203 ~]# yum clean all 清空yun缓存
[root@desktop203 ~]# yum repolist 列出yum源中有多少安装包，查看是否配置完成
若出现进程错误

[root@desktop203 ~]# kill -9 进程号 关闭进程
[root@desktop203 ~]# yum clean all 清空yun缓存

二.安装cifs软件samba

1.samba作用

samba是一款软件，主要提供cifs协议

2.samba的安装与启用

*)在客户端desktop

[root@desktop203 ~]# yum whatprovides */smbclient //查找服务安装包
Loaded plugins: langpacks
rhel_dvd/filelists_db | 3.0 MB 00:00
samba-client-4.1.1-31.el7.x86_64 : Samba client programs
[root@desktop203 ~]# yum install samba-client -y //安装
在desktop关闭防火墙
systemctl stop firewalld
systemctl mask firewalld
[root@desktop203 ~]# smbclient -L //172.25.254.103 //尝试登陆失败
Enter root’s password:
Connection to 172.25.254.103 failed (Error NT_STATUS_CONNECTION_REFUSED)

*）在服务端server

[root@desktop203 ~]# yum search samba //查找samba软件
samba-common.x86_64 : Files used by both Samba servers and clients
samba-client.x86_64 : Samba client programs
samba.x86_64 : Server and Client software to interoperate with Windows
: machines
[root@desktop203 ~]# yum install samba-common samba-client samba -y //安装
[root@server103 ~]# systemctl start smb //启动samba
[root@server103 ~]# systemctl enable smb
[root@server103 ~]# systemctl stop firewalld
[root@server103 ~]# systemctl mask firewalld
[root@server103 ~]# ss -antlupe | grep smb //查看端口,smb是445和139端口

*）desktop客户端

[root@desktop203 ~]# smbclient -L //172.25.254.103 //列出某个IP地址所提供的共享文件夹
Enter root’s password:

Anonymous login successful

*）samba的基本信息

端口： 130/tcp 139/udp 445/tcp 445/udp
主配置文件： /etc/samba/smb.conf

*)基本配置信息

workgroup = WESTOS ##工作组的设定
server string = hello world ##全局共享信息
hosts deny = 172.25.254.250 ##客户端黑名单
hosts allow = 172.25.254.203 ##客户端白名单

三.配置主配置文件

*)服务端

[root@server103 ~]# vim /etc/samba/smb.conf
90 workgroup = WESTOS_server103
92 server string = hello world 103
98 hosts allow = 172.25.254.203
99 hosts deny = 172.25.254.20 172.25.254.120 172.25.254.220
[root@server103 ~]# systemctl restart smb.service

*）在客户端测试

[root@desktop203 ~]# smbclient -L //172.25.254.103

【samba设置】

仅说明信息，windows只能看到说明信息
加上/24表示网段。172.25.254.也表示网段
白名单hosts allow = 172.25.254.203
黑名单hosts deny = 172.25.254.220

四.DNS的bug控制

若出现以下问题【设置了DNS，没设置不会出现】
[root@desktop203 ~]# smbclient -L //172.25.254.103
Enter root’s password:
protocol negotiation failed: NT_STATUS_IO_TIMEOUT
解决方法：
在服务器端
[root@server103 ~]# vim /etc/hosts 中加入本地解析
6 172.25.254.103 server103
重新smbclient -L//172.25.254.103重新列出该ip提供的共享文加夹即可

五.本地用户的建立与访问

1.本地用户建立

[root@server103 ~]# id westos //查找本地用户
id: westos: no such user //无本地用户

*）server服务端

!!samba用户必须是本地用户
[root@server103 ~]# useradd westos
[root@server103 ~]# useradd lee
[root@server103 ~]# passwd westos
[root@server103 ~]# passwd lee
[root@server103 ~]# smbpasswd -a westos //建立
New SMB password:
Retype new SMB password:
Added user westos.
[root@server103 ~]# smbpasswd -a lee //建立
New SMB password:
Retype new SMB password:
Added user lee.
[root@server103 ~]# pdbedit -L //列出samba用户
westos:1001:
lee:1002:
[root@server103 ~]# pdbedit -x westos //删除用户
[root@server103 ~]# pdbedit -L
lee:1002:

*)desktop客户端登陆samba用户

[root@desktop203 ~]# smbclient -L //172.25.254.103 -U lee
Enter lee’s password: //登陆成功不显示匿名用户相关信息
[root@desktop203 ~]# smbclient -L //172.25.254.103 -U lee
Enter lee’s password:
Anonymous login successful //密码错误进入匿名用户

*)desktop客户端分那个文lee的samba家目录

[root@desktop203 ~]# smbclient //172.25.254.103/lee -U lee
Enter lee’s password:
Domain=[WESTOS_SERVER103] OS=[Unix] Server=[Samba 4.1.1]
smb: >
smb: > ls //缺少selinux设置无法访问本地用户家目录
lee: command not found

*)server 服务端更改selinux

[root@server103 ~]# getenforce
Permissive
*)desktop客户端
smb: > ls
. D 0 Sun Feb 25 21:50:39 2018
.. D 0 Sun Feb 25 21:50:39 2018
.bash_logout H 18 Wed Jan 29 07:45:18 2014
.bash_profile H 193 Wed Jan 29 07:45:18 2014
.bashrc H 231 Wed Jan 29 07:45:18 2014
.mozilla DH 0 Thu Jul 10 18:29:32 2014
.config DH 0 Thu Jul 10 19:06:52 2014

40913 blocks of size 262144. 28582 blocks available
!!!!!!!!!此时便可以访问

2.设定selinux波尔值

*)server

[root@server103 ~]# setenforce 1
[root@server103 ~]# getenforce
Enforcing
[root@server103 ~]# getsebool -a | grep samba //查看

在主配置文件中查看说明

[root@server103 ~]# setsebool -P samba_enable_home_dirs on //开启
[root@server103 ~]# getsebool -a | grep samba //查看
samba_enable_home_dirs –> on

*)desktop客户端测试

sambaclient -L //172.25.254.103/lee -U lee
smb: > ls
. D 0 Sun Feb 25 21:50:39 2018
.. D 0 Sun Feb 25 21:50:39 2018
.bash_logout H 18 Wed Jan 29 07:45:18 2014
.bash_profile H 193 Wed Jan 29 07:45:18 2014
.bashrc H 231 Wed Jan 29 07:45:18 2014
.mozilla DH 0 Thu Jul 10 18:29:32 2014
.config DH 0 Thu Jul 10 19:06:52 2014

    40913 blocks of size 262144. 28582 blocks available

!!!!!!!!!此时便可以访问

六.挂载方式实现

1.临时挂载

[root@desktop203 ~]# mount //172.25.254.103/lee /mnt/ -o username=lee,password=lee
[root@desktop203 ~]# df
//172.25.254.103/lee 10473900 3158276 7315624 31% /mnt

2.编辑文件实现永久挂载

[root@desktop203 mnt]# vim /etc/fstab
//172.25.254.103/lee /mnt cifs defaults,username=lee,password=lee 0 0
[root@desktop203 ~]# mount -a
[root@desktop203 ~]# df
//172.25.254.103/lee 10473900 3158276 7315624 31% /mnt //挂载成功

3.检测

在desktop下
[root@desktop203 ～]# cd /mnt
[root@desktop203 mnt]# touch file
[root@desktop203 mnt]# ls
file westos
在server中
[root@server103 ~]# cd /home/lee/
[root@server103 lee]# ls
file westos

八.自定义共享目录

查看模板文件
[root@server103 ~]# vim /etc/samba/smb.conf
286 [homes]
287 comment = Home Directories
288 browseable = no
289 writable = yes
290 ; valid users = %S
291 ; valid users = MYDOMAIN\%S
[root@server103 ~]# systemctl restart smb.service
全部注释掉（;）后便无法访问本地共享目录

1.当目录是用户建立时

*)在server中

[root@server103 ~]# mkdir /samba
[root@server103 ~]# ls -ld /samba/
drwxr-xr-x. 2 root root 6 Feb 25 22:48 /samba/
[root@server103 ~]# vim /etc/samba/smb.conf
326 [data]
327 comment = local sambadir
328 path = /samba
[root@server103 ~]# systemctl restart smb.service

*)在desktop中检测是否设置成功

[root@desktop203 ~]# smbclient -L //172.25.254.103
data Disk local sambadir //成功
[root@desktop203 ~]# smbclient //172.25.254.103/data
Enter root’s password:
Anonymous login successful
Domain=[WESTOS_SERVER103] OS=[Unix] Server=[Samba 4.1.1]
tree connect failed: NT_STATUS_ACCESS_DENIED
此时需要设置安全上下文或调整SElinux设置

方法一

[root@server103 ~]# setenforce 1 //更改为0
Enforcing

方法二

配置文件中第40行
[root@server103 ~]# vim /etc/samba/smb.conf //临时修改
40 # Set SELinux labels only on files and directories you have create d. Use the

方法三 //永久修改

[root@server103 ~]# semanage fcontext -a -t samba_share_t ‘/samba(/.*)?’
[root@server103 ~]# restorecon -FvvR /samba/
restorecon reset /samba context unconfined_u:object_r:default_t:s0->system_u:object_r:samba_share_t:s0

测试

smbclient -L //172.25.254.103 -U lee //列出
smbclient //172.25.254.103/DATA -U lee
ls

!!!若无法卸载，
fuser -vm /mnt/ 查看占用进程
kill -9 进程号 关闭进程

2.当目录是系统目录时

[root@server103 mnt]# vim /etc/samba/smb.conf
332 [SYSTEMCTLDATA]
333 comment = hello world
334 path = /mnt
[root@server103 mnt]# systemctl restart smb.service
更改SElinux设置
chcon samba_share_t /mnt/ //临时
查看配置文件说明[root@server103 mnt]# vim /etc/samba/smb.conf
49 # setsebool -P samba_export_all_ro on
[root@server103 mnt]# setsebool -P samba_export_all_ro on

验证：

[root@desktop203 ~]# mount //172.25.254.103/SYSTEMCTLDATA /mnt/ -o username=lee,password=lee //挂载
[root@desktop203 ~]# df
//172.25.254.103/SYSTEMCTLDATA 10473900 3158544 7315356 31% /mnt
[root@desktop203 ~]# smbclient //172.25.254.103/SYSTEMDATA -U lee //登陆
登陆后pwd查看位置
ls查看文件，验证成功（现在服务器中建立/mnt下文件）

九.匿名用户登陆权限开放

主配置文件第127,315行参考
[root@server103 ~]# vim /etc/samba/smb.conf
127 # security = user
128 security = shared //可分享的
129 passdb backend = tdbsam
130 map to guest = bad user //匿名用户可以用guest进行挂载
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
327 [DATA]
328 comment = local sambadir
329 path = /samba
330 guest ok = yes //匿名用户可以登陆
[root@desktop203 ~]# mount //172.25.254.103/DATA /mnt/ -o username=guest //挂载

十.权限控制

用户可写

[root@desktop203 mnt]# vim /etc/fstab //更改开机默认文件
//172.25.254.103/DATA /mnt cifs defaults,username=lee,password=lee 0 0
[root@desktop203 ~]# umount /mnt
[root@desktop203 ~]# mount -a
[root@desktop203 ~]# df
//172.25.254.103/DATA 10473900 3158508 7315392 31% /mnt
[root@desktop203 mnt]# touch file5
touch: cannot touch ‘file5’: Permission denied //此时权力受到限制

[root@server103 mnt]# chmod 777 /samba/ //更改权限
[root@server103 mnt]# ls -ld /samba/
drwxrwxrwx. 2 root root 6 Feb 25 22:48 /samba/
[root@server103 mnt]# vim /etc/samba/smb.conf
331 writable = yes
[root@desktop203 ~]# umount /mnt
**[root@desktop203 ~]# cd /mnt
[root@desktop203 mnt]# ls**
[root@desktop203 mnt]# touch file
[root@desktop203 mnt]# ls
file
[root@desktop203 mnt]# mount //172.25.254.103/DATA /mnt -o password=lee,username=lee
[root@desktop203 mnt]# touch file2
[root@desktop203 mnt]# ls
file file2
[root@server103 mnt]# getsebool -a |grep samba //查看
[root@server103 mnt]# setsebool -P samba_export_all_rw on //允许所有人可读可写
[root@server103 mnt]# vim /etc/samba/smb.conf
332 write list = +lee
[root@desktop203 ~]# umount /mnt
[root@desktop203 ~]# mount //172.25.254.103/DATA /mnt -o password=lee,username=lee
[root@desktop203 mnt]# touch file1
**[root@desktop203 mnt]# ll
total 0**
-rw-r–r– 1 1002 1002 0 Feb 26 02:10 file1
[root@server103 ~]# id 1002
uid=1002(lee) gid=1002(lee) groups=1002(lee)

验证用户组

[root@server103 ~]# usermod -G lee westos
[root@server103 ~]# id westos
uid=1001(westos) gid=1001(westos) groups=1001(westos),1002(lee)
[root@desktop203 mnt]# cd
[root@desktop203 ~]# umount /mnt/
[root@desktop203 ~]# mount //172.25.254.103/DATA /mnt/ -o username=westos,password=westos
[root@desktop203 ~]# cd /mnt
[root@desktop203 mnt]# touch file3
[root@desktop203 mnt]# ll
-rw-r–r– 1 1002 1002 0 Feb 26 02:10 file1
-rw-r–r– 1 1001 1001 0 Feb 26 02:18 file3

匿名用户

[root@desktop203 mnt]# cd
[root@desktop203 ~]# umount /mnt/
[root@desktop203 ~]# mount //172.25.254.103/DATA /mnt/ -o username=guest
[root@desktop203 mnt]# touch file
[root@desktop203 mnt]# ll
total 0
-rw-r–r– 1 nobody nobody 0 Feb 26 02:20 file
[root@server103 ~]# id nobody //匿名用户默认为nobody
uid=99(nobody) gid=99(nobody) groups=99(nobody)

writeable = yeswrite = yes | no //是否开启写权力
write list = lee //写权力对lee用户开放
write list = +lee //写权力对lee组用户开放，+与@都可以，测试是注释writeable
admin users = westos //设定westos用户为当前共享的root
valid users = lee //设定当前共享的有效用户
browseable = yes | no //当前共享是否隐藏

‘###admin users = westos
[root@server103 ~]# chmod 755 /samba/
[root@desktop203 ~]# umount /mnt
[root@desktop203 ~]# mount //172.25.254.103/DATA /mnt -o password=westos,username=westos
[root@desktop203 ~]# touch /mnt/file1
touch: cannot touch ‘/mnt/file1’: Permission denied
[root@server103 ~]# vim /etc/samba/smb.conf
332 ; write list = +lee
[root@server103 ~]# systemctl restart smb.service
此时在desktop挂载westos后在/mnt下无法创建file
[root@server103 ~]# vim /etc/samba/smb.conf
333 admin users = westos
[root@server103 ~]# systemctl restart smb.service
[root@desktop203 mnt]# touch file
[root@desktop203 mnt]# ls
file
[root@desktop203 mnt]# ll
total 0
-rw-r–r– 1 root 1001 0 Feb 26 03:00 file //此时的用户为root，用户组为westos

‘###valid users = lee //设定当前共享的有效用户,进去后能否浏览
[root@server103 ~]# vim /etc/samba/smb.conf
333 ; admin users = westos
334 valid users = lee
[root@desktop203 ~]# mount //172.25.254.103/DATA /mnt -o password=lee,username=lee
[root@desktop203 ~]# mount //172.25.254.103/DATA /mnt -o password=westos,username=westos
mount: //172.25.254.103/DATA is write-protected, mounting read-only
mount: cannot mount //172.25.254.103/DATA read-only
此时用lee可以进去，别的进不去

‘###browseable = yes | no //当前共享是否隐藏
[root@server103 ~]# vim /etc/samba/smb.conf
browseable = no
[root@server103 ~]# systemctl restart smb.service
[root@desktop203 ~]# smbclient -L //172.25.254.103

///此时，为no，不显示date
[root@desktop203 ~]# smbclient -L //172.25.254.103

///此时，为yes，显示date信息

十一.samba的多用户挂载

mount //172.25.254.103/DATA /mnt -o username=westos,password=westos
su - student
[student@desktop203 mnt]$ ls //此时可以看到file，不合理！！
file

1.客户端desktop中

[root@desktop203 ~]# yum install cifs-utils.x86_64 -y
**[root@desktop203 ~]# vim /root/smbpassword
username=lee**
password=lee
[root@desktop203 ~]# chmod 600 /root/smbpassword
[root@desktop203 ~]# ll
-rw——- 1 root root 26 Feb 26 03:53 smbpassword
[root@desktop203 ~]# mount -o credentials=/root/smbpassword,sec=ntlmssp,multiuser //172.25.254.103/DATA /mnt/
credentials=/root/smbpassword ##挂载时的用户认证
multiuser ##支持其他的用户认证
sec=ntlmssp ##其他用户的认证

2.测试

ls /mnt
su - student
ls /mnt
ls: reading directory .: Permission denied
在student下
cifscreds add -u westos 172.25.254.103
若第二次add改为update
ls /mnt
touch /mnt/file5
可以看到建立的file5所用到的用户身份时samba用户westos