Konfiguracja samba LINUX

Poniżej prezen­tu­je­my sposób na uru­chomie­nie i kon­fig­u­rację sys­te­mu udostęp­ni­a­nia plików i drukarek samba.
Artykuł opisu­je pod­sta­wowe kon­fig­u­rac­je i narzędzia samba…

1) W celu insta­lacji paki­etu sam­ba na sys­temach dębin wykonu­je­my polecenie:

apt-get install sam­ba samba-client

,w cza­sie insta­lacji man­ag­er paki­etów "apt" pyta nas o nazwę grupy roboczej, poda­je­my nazwę np. biuro;

 

2) Plik kon­fig­u­ra­cyjny sam­by zna­j­du­je się w /etc/samba/smb.conf

Warto sko­pi­ować plik do kat­a­logu usera np.:

cp /etc/samba/smb.conf /home/user/samba/smb.bak

 

Przykładowy plik kon­fig­u­ra­cyjny samby:

#======================= =======================

 

[glob­al]

## Browsing/Identification ###

# Change this to the workgroup/NT-domain name your Samba serv­er will part of

work­group = biuro

# serv­er string is the equiv­a­lent of the NT Description field

serv­er string = biuro

 

# Windows Internet Name Serving Support Section:

# WINS Support — Tells the NMBD com­po­nent of Samba to enable its WINS Server

# wins sup­port = no

# WINS Server — Tells the NMBD com­po­nents of Samba to be a WINS Client

# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both

; wins serv­er = w.x.y.z

# This will pre­vent nmbd to search for NetBIOS names through DNS.

dns proxy = no

# What nam­ing ser­vice and in what order should we use to resolve host names

# to IP addresses

name resolve order = lmhosts host wins bcast

#### Networking ####

# The spe­cif­ic set of inter­faces / net­works to bind to

# This can be either the inter­face name or an IP address/netmask;

# inter­face names are nor­mal­ly preferred

; inter­faces = 127.0.0.0/8 eth0

inter­faces = 127.0.0.1 192.168.1.251

 

# Only bind to the named inter­faces and/or net­works; you must use the

# 'inter­faces' option above to use this.

# It is rec­om­mend­ed that you enable this fea­ture if your Samba machine is

# not pro­tect­ed by a fire­wall or is a fire­wall itself. However, this

# option can­not han­dle dynam­ic or non-broad­cast inter­faces correctly.

; bind inter­faces only = yes

bind inter­faces only = yes

 

#### Debugging/Accounting ####

 

# This tells Samba to use a sep­a­rate log file for each machine

# that connects

log file = /var/log/samba/log.%m

# Cap the size of the indi­vid­ual log files (in KiB).

max log size = 1000

 

# If you want Samba to only log through sys­log then set the following

# para­me­ter to 'yes'.

# sys­log only = no

 

# We want Samba to log a min­i­mum amount of infor­ma­tion to sys­log. Everything

# should go to /var/log/samba/log.{smbd,nmbd} instead. If you want to log

# through sys­log you should set the fol­low­ing para­me­ter to some­thing higher.

sys­log = 0

 

# Do some­thing sen­si­ble when Samba crash­es: mail the admin a backtrace

pan­ic action = /us­r/share/sam­ba/­pan­ic-action %d

####### Authentication #######

 

# "secu­ri­ty = user" is always a good idea. This will require a Unix account

# in this serv­er for every user access­ing the serv­er. See

# /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/ServerType.html

# in the sam­ba-doc pack­age for details.

secu­ri­ty = user

 

# You may wish to use pass­word encryp­tion. See the sec­tion on

# 'encrypt pass­words' in the smb.conf(5) man­page before enabling.

encrypt pass­words = true

 

# If you are using encrypt­ed pass­words, Samba will need to know what

# pass­word data­base type you are using.

pass­db back­end = tdbsam

 

obey pam restric­tions = yes

 

# This boolean para­me­ter con­trols whether Samba attempts to sync the Unix

# pass­word with the SMB pass­word when the encrypt­ed SMB pass­word in the

# pass­db is changed.

unix pass­word sync = yes

 

# For Unix pass­word sync to work on a Debian GNU/Linux sys­tem, the following

# para­me­ters must be set (thanks to Ian Kahan <<kahan@informatik.tu-muenchen.de> for

# send­ing the cor­rect chat script for the pass­wd pro­gram in Debian Sarge).

pass­wd pro­gram = /usr/bin/passwd %u

pass­wd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .

 

# This boolean con­trols whether PAM will be used for pass­word changes

# when request­ed by an SMB client instead of the pro­gram list­ed in

# 'pass­wd pro­gram'. The default is 'no'.

pam pass­word change = yes

 

# This option con­trols how unsuc­cess­ful authen­ti­ca­tion attempts are mapped

# to anony­mous connections

map to guest = bad user

 

########## Domains ###########

 

# Is this machine able to authen­ti­cate users. Both PDC and BDC

# must have this set­ting enabled. If you are the BDC you must

# change the 'domain mas­ter' set­ting to no

#

; domain logons = yes

#

# The fol­low­ing set­ting only takes effect if 'domain logons' is set

# It spec­i­fies the loca­tion of the user's pro­file directory

# from the client point of view)

# The fol­low­ing required a [pro­files] share to be set­up on the

# sam­ba serv­er (see below)

; logon path = \\%N\profiles\%U

# Another com­mon choice is stor­ing the pro­file in the user's home directory

# (this is Samba's default)

# logon path = \\%N\%U\profile

 

# The fol­low­ing set­ting only takes effect if 'domain logons' is set

# It spec­i­fies the loca­tion of a user's home direc­to­ry (from the client

# point of view)

; logon dri­ve = H:

# logon home = \\%N\%U

 

# The fol­low­ing set­ting only takes effect if 'domain logons' is set

# It spec­i­fies the script to run dur­ing logon. The script must be stored

# in the [net­l­o­gon] share

# NOTE: Must be store in 'DOS' file for­mat convention

; logon script = logon.cmd

 

# This allows Unix users to be cre­at­ed on the domain con­troller via the SAMR

# RPC pipe. The exam­ple com­mand cre­ates a user account with a dis­abled Unix

# pass­word; please adapt to your needs

; add user script = /usr/sbin/adduser –qui­et –dis­abled-pass­word –gecos "" %u

 

# This allows machine accounts to be cre­at­ed on the domain con­troller via the

# SAMR RPC pipe.

# The fol­low­ing assumes a "machines" group exists on the system

; add machine script = /usr/sbin/useradd ‑g machines ‑c "%u machine account" ‑d /var/lib/samba ‑s /bin/false %u

 

# This allows Unix groups to be cre­at­ed on the domain con­troller via the SAMR

# RPC pipe.

; add group script = /usr/sbin/addgroup –force-bad­name %g

 

########## Printing ##########

 

# If you want to auto­mat­i­cal­ly load your print­er list rather

# than set­ting them up indi­vid­u­al­ly then you'll need this

# load print­ers = yes

 

# lpr(ng) print­ing. You may wish to over­ride the loca­tion of the

# print­cap file

; print­ing = bsd

; print­cap name = /etc/printcap

 

# CUPS print­ing. See also the cupsaddsmb(8) man­page in the

# cup­sys-client package.

; print­ing = cups

; print­cap name = cups

 

############ Misc ############

 

# Using the fol­low­ing line enables you to cus­tomise your configuration

# on a per machine basis. The %m gets replaced with the net­bios name

# of the machine that is connecting

; include = /home/samba/etc/smb.conf.%m

 

# Most peo­ple will find that this option gives bet­ter performance.

# See smb.conf(5) and /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/speed.html

# for details

# You may want to add the fol­low­ing on a Linux system:

# SO_RCVBUF=8192 SO_SNDBUF=8192

# sock­et options = TCP_NODELAY

 

# The fol­low­ing para­me­ter is use­ful only if you have the lin­pop­up package

# installed. The sam­ba main­tain­er and the lin­pop­up main­tain­er are

# work­ing to ease instal­la­tion and con­fig­u­ra­tion of lin­pop­up and samba.

; mes­sage com­mand = /bin/sh ‑c '/usr/bin/linpopup "%f" "%m" %s; rm %s' &

 

# Domain Master spec­i­fies Samba to be the Domain Master Browser. If this

# machine will be con­fig­ured as a BDC (a sec­ondary logon serv­er), you

# must set this to 'no'; oth­er­wise, the default behav­ior is recommended.

# domain mas­ter = auto

 

# Some defaults for win­bind (make sure you're not using the ranges

# for some­thing else.)

; idmap uid = 10000–20000

; idmap gid = 10000–20000

; tem­plate shell = /bin/bash

 

# The fol­low­ing was the default behav­iour in sarge,

# but sam­ba upstream revert­ed the default because it might induce

# per­for­mance issues in large organizations.

# See Debian bug #368251 for some of the con­se­quences of *not*

# hav­ing this set­ting and smb.conf(5) for details.

; win­bind enum groups = yes

; win­bind enum users = yes

 

# Setup user­share options to enable non-root users to share folders

# with the net user­share command.

 

# Maximum num­ber of user­share. 0 (default) means that user­share is disabled.

; user­share max shares = 100

 

# Allow users who've been grant­ed user­share priv­i­leges to create

# pub­lic shares, not just authen­ti­cat­ed ones

user­share allow guests = yes

 

#======================= Share Definitions =======================

 

[homes]

com­ment = Home Directories

browseable = no

 

# By default, the home direc­to­ries are export­ed read-only. Change the

# next para­me­ter to 'no' if you want to be able to write to them.

read only = yes

 

# File cre­ation mask is set to 0700 for secu­ri­ty rea­sons. If you want to

# cre­ate files with group=rw per­mis­sions, set next para­me­ter to 0775.

cre­ate mask = 0777

 

# Directory cre­ation mask is set to 0700 for secu­ri­ty rea­sons. If you want to

# cre­ate dirs. with group=rw per­mis­sions, set next para­me­ter to 0775.

direc­to­ry mask = 0777

 

# By default, \\server\username shares can be con­nect­ed to by anyone

# with access to the sam­ba server.

# The fol­low­ing para­me­ter makes sure that only "user­name" can connect

# to \\server\username

# This might need tweak­ing when using exter­nal authen­ti­ca­tion schemes

valid users = %S

 

# Un-com­ment the fol­low­ing and cre­ate the net­l­o­gon direc­to­ry for Domain Logons

# (you need to con­fig­ure Samba to act as a domain con­troller too.)

;[net­l­o­gon]

; com­ment = Network Logon Service

; path = /home/samba/netlogon

; guest ok = yes

; read only = yes

 

# Un-com­ment the fol­low­ing and cre­ate the pro­files direc­to­ry to store

# users pro­files (see the "logon path" option above)

# (you need to con­fig­ure Samba to act as a domain con­troller too.)

# The path below should be writable by all users so that their

# pro­file direc­to­ry may be cre­at­ed the first time they log on

;[pro­files]

; com­ment = Users profiles

; path = /home/samba/profiles

; guest ok = no

; browseable = no

; cre­ate mask = 0600

; direc­to­ry mask = 0700

 

[print­ers]

com­ment = All Printers

browseable = no

path = /var/spool/samba

print­able = yes

guest ok = no

read only = yes

cre­ate mask = 0700

 

# Windows clients look for this share name as a source of downloadable

# print­er drivers

[print$]

com­ment = Printer Drivers

path = /var/lib/samba/printers

browseable = yes

read only = yes

guest ok = no

# Uncomment to allow remote admin­is­tra­tion of Windows print drivers.

# You may need to replace 'lpad­min' with the name of the group your

# admin users are mem­bers of.

# Please note that you also need to set appro­pri­ate Unix permissions

# to the dri­vers direc­to­ry for these users to have write rights in it

; write list = root, @lpadmin

 

# A sam­ple share for shar­ing your CD-ROM with others.

;[cdrom]

; com­ment = Samba server's CD-ROM

; read only = yes

; lock­ing = no

; path = /cdrom

; guest ok = yes

 

# The next two para­me­ters show how to auto-mount a CD-ROM when the

# cdrom share is accesed. For this to work /etc/fstab must contain

# an entry like this:

#

# /dev/scd0 /cdrom iso9660 defaults,noauto,ro,user 0 0

#

# The CD-ROM gets unmount­ed auto­mat­i­cal­ly after the con­nec­tion to the

#

# If you don't want to use auto-mount­ing/un­mount­ing make sure the CD

# is mount­ed on /cdrom

#

; pre­ex­ec = /bin/mount /cdrom

; pos­tex­ec = /bin/umount /cdrom

 

[UDZIAL1]

com­ment = UDZIAL1

read only = no

lock­ing = no

path = /data/udzial1

guest ok = no

browseable = yes

cre­ate mode = 0777

direc­to­ry mode = 0777

force user = user_a

force group = users

user­name = user_a

 

[UDZIAL2]

com­ment = UDZIAL2

read only = no

lock­ing = no

path = /data/udzial2

guest ok = no

browseable = yes

cre­ate mode = 0777

direc­to­ry mode = 0777

force user = user_a

force group = users

user­name = user_a

 

#======================= =======================

 

3) Należy jeszcze ustaw­ić prawa do udostęp­ni­anych katalogów:

chmod 777 –R /data/udzial_1
chmod 777 –R /data/udzial_2

4) Do kat­a­logów i plików trze­ba też określić właściciela:

chown ‑R user_a:users /data/udział_1
chown ‑R user_a:users /data/udział_2

, gdzie para­metr –R określa rekurencję
5) Aby użytkown­ik połączył się z udzi­ałem sam­by trze­ba go założyć:

# smb­pass­wd [opc­je] [uzytkown­ik] [nowe_hasło]

Opcje:

• ‑h — wyświ­et­la pomoc
• ‑a — doda­je użytkown­i­ka do bazy,
• ‑x — usuwa użytkown­i­ka z bazy,
• ‑d — wyłącza konto,
• ‑e — włącza konto,
• ‑n — usuwa hasło.

,czyli smb­pass­wd –a user_a haslo

6) Aby wprowad­zone zmi­any mogły być zas­tosowane, konieczne jest zrestar­towanie samby:

/etc/init.d/samba restart

7) Na stacji win­dows może­my podłączyć się pod zasób poleceniem:

\\192.168.1.251\UDZIAL_1

 

8) Inne narzędzia

a) Rozwiązywanie nazw:

# nmblookup Serwer

spowodu­je wyszukanie adresu IP dla nazwy NetBIOS Serwer. *Wyszukiwanie jest tylko w bieżącej pod­sieci, do wyszuki­wa­nia w innych pod­sieci­ach musimy sko­rzys­tać z możli­woś­ci ser­w­era WINS.

b) Klient samby

Za pomocą narzędzia smb­client mamy możli­wość oper­owa­nia na zdal­nym serwerze.

Ogólna skład­nia tego polece­nia jest następująca:

# smb­client udzi­ał [hasło] [opc­je]

a niek­tóre z opcji to:

• ‑p port — połącz na podanym porcie,
• ‑N — nie pytaj o hasło,
• ‑U uzytkown­ik — określa nazwę użytkownika,
• ‑L host — pobiera listę udzi­ałów z podanego hosta,
• ‑D kat­a­log — star­tu­je z podanego katalogu.

Po naw­iąza­niu połączenia pojaw­ia się znak zachę­ty i może­my rozpocząć wydawanie pole­ceń. Warto pamię­tać, że w każdym momen­cie może­my wpisać polecenie

Smb: /> help

,które wyp­isze nam listę wszys­t­kich dostęp­nych pole­ceń, a następ­nie może­my wpisać polecenie:

Smb: /> help polecenie

które opisze nam dane polecenie.

Z najbardziej pod­sta­wowych pole­ceń to

• ls – pokazu­je zawartość bieżącego katalogu,
• cd – zmienia bieżą­cy katalog,
• get – pobiera wskazany plik z serwera,
• put – kopi­u­je wskazany lokalnie plik na serwer.

Kilka przykładów użycia:

# smb­client \\\\biuro\\udzial_1 ‑U user_a

# smb­client ‑L \\\\192.168.1.251 ‑N

# smb­client ‑L //192.168.0.251 ‑N

Za pomocą smb­client może­my także wydrukować coś na drukarce udostęp­nionej przez SMB:

# smb­client //biuro/hplj1022 ‑c 'print plik.ps'
c) Montowanie udostęp­nienia na stacji klienck­iej LINUX

Konieczne będzie zain­stalowanie paki­etu cifs-utils poleceniem:

apt-get install cifs-utils

Na klien­cie może­my zamon­tować dany udzi­ał poleceniem:

mount ‑t cifs //192.168.1.251/UDZIAL_1 /mnt/mountpoint ‑o user=nobody

d) Podłączanie zasobów na stacji klien­ciej LINUX

Do podłącza­nia (mon­towa­nia) zasobów wyko­rzys­tu­je­my polece­nie mount wskazu­jąc jako typu plików cifs (zale­cany) lub smbfs (starszy). Podstawowa składnia:

mount ‑t smbfs [-o opc­je] udzi­ał sciezka

gdzie najczęś­ciej uży­wane opc­je to:

• username=uzytkownik — określamy nazwę użytkownika,
• password=haslo — przekazu­je­my hasło; jeśli go nie podamy, zostaniemy o nie zapytani,
• ro, rw — określa tryb: odpowied­nio tylko do odczy­tu lub do odczy­tu i zapisu.

Przykładowe uży­cie:

# mount ‑t smbfs ‑o username=user_a,password=haslo \\\\192.168.1.251\\udzial_1 /mnt/win