CIFS
一、CIFS
1.CIFS系统：Internet文件共享系统，也称服务器信；适用于MicrosoftWindows服务器和客户端的标准文件和打印机的共享系统息块（SMB）
2.Samba服务：用于将linux文件系统作为CIFS/SMB网络文件进行共享，并将linux打印机作为CIFS/SMB打印机进行共享
二、Smb服务
samba-common
samba-client
2.打开smb，列出共享文件系统信息
Anonymous login successful
Domain=[MYGROUP] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
IPC$ IPC IPC Service (Samba Server Version 4.1.1)
Anonymous login successful
Domain=[MYGROUP] OS=[Unix] Server=[Samba 4.1.1]
Server Comment
--------- -------
Workgroup Master
--------- -------
4.设置黑白名单 [global]
5.设置用户登陆 ##注意：必须是本地用户
[[email protected] ~]# useradd tom
[[email protected] ~]# useradd jerry
Retype new SMB password:
Added user tom.
Retype new SMB password:
Added user jerry.
[[email protected] ~]# pdbedit -L ##列出smb用户
tom:1001:
jerry:1002:
tom:1001:
6.使用用户登陆
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
IPC$ IPC IPC Service (Samba Server Version 4.1.1)
三、Smb的Selinx保护
当Selinux=Disable时
1.进入用户家目录编辑
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
.. D 0 Thu May 3 21:46:34 2018
.bash_profile H 193 Wed Jan 29 07:45:18 2014
.mozilla DH 0 Thu Jul 10 18:29:32 2014
.config DH 0 Thu Jul 10 19:06:52 2014
.bashrc H 231 Wed Jan 29 07:45:18 2014
.bash_logout H 18 Wed Jan 29 07:45:18 2014
smb: \> !ls ##列出本地主机文件
anaconda-ks.cfg Documents Music Public Videos
Desktop Downloads Pictures Templates
blocksize cancel case_sensitive cd chmod
chown close del dir du
echo exit get getfacl geteas
2.挂载
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/vda1 10473900 3186240 7287660 31% /
devtmpfs 469344 0 469344 0% /dev
tmpfs 484932 140 484792 1% /dev/shm
tmpfs 484932 12828 472104 3% /run
tmpfs 484932 0 484932 0% /sys/fs/cgroup
/dev/mapper/vg0-vo 483670 2361 451818 1% /home
/dev/sr0 3654720 3654720 0 100% /run/media/root/RHEL-7.0 Server.x86_64
3.设置开机自动挂载
[[email protected] ~]# vim /etc/fstab
use_samba_home_dirs ##允许挂载远程CIFS文件共享并将其用作本地主目录
samba_share_t ##smb共享目录的selinux安全上下文
samba_export_all_ro ##共享目录只读
samba_export_all_rw ##允许共享目录读写
1.进入用户家目录编辑
[[email protected] ~]# smbclient //172.25.254.108/tom -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
2.修改sebool值，进入用户家目录编辑
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
. D 0 Thu May 3 21:49:51 2018
.. D 0 Thu May 3 21:46:34 2018
.bash_profile H 193 Wed Jan 29 07:45:18 2014
.mozilla DH 0 Thu Jul 10 18:29:32 2014
.config DH 0 Thu Jul 10 19:06:52 2014
.bashrc H 231 Wed Jan 29 07:45:18 2014
.bash_logout H 18 Wed Jan 29 07:45:18 2014
3.共享目录
用户建立目录:
修改配置文件，共享tets目录
comment = test directory
path =/test
重启smb，可以看到test目录共享信息
[[email protected] ~]# systemctl restart smb.service
[[email protected] ~]# smbclient -L //172.25.254.108/
Enter root's password:
Anonymous login successful
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
test Disk test directory
IPC$ IPC IPC Service (Samba Server Version 4.1.1)
但是，tom用户登陆无法编辑
[[email protected] ~]# smbclient //172.25.254.108/test -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*
修改test目录的安全上下文，重启后再次登陆编辑
restorecon reset /test context unconfined_u:object_r:default_t:s0->system_u:object_r:samba_share_t:s0
[[email protected] ~]# systemctl restart smb.service
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
. D 0 Thu May 3 22:48:51 2018
.. D 0 Thu May 3 22:48:51 2018
系统目录：
修改配置文件，共享mnt系统目录
[[email protected] ~]# vim /etc/samba/smb.conf
[mnt]
comment = mnt test directory
[[email protected] ~]# systemctl restart smb.service
[[email protected] ~]# smbclient -L //172.25.254.108/
Enter root's password:
Anonymous login successful
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
test Disk test directory
mnt Disk mnt test directory
[[email protected] ~]# setsebool samba_export_all_rw 1
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
. D 0 Thu May 11 20:23:52 2017
.. D 0 Thu May 3 22:48:51 2018
四、多用户挂载
1.指定用户具备读写权限
[[email protected] ~]# vim /etc/samba/smb.conf
[test]
comment = test directory
path =/test
write list =tom ##只有tom用户具备权限
##writable = yes ##所有用户具备权限
2.设定共享目录的读写权限，重启后测试
[[email protected] ~]# chmod 777 /test/
[[email protected] ~]# systemctl restart smb.service
只有tom用户具备权限
[[email protected] ~]# rm -rf /mnt/file1
挂载jerry用户，不具备权限
[[email protected] ~]# umount /mnt
[[email protected] ~]# mount //172.25.254.108/test /mnt -o username=jerry,password=123
[[email protected] ~]# touch /mnt/file2
3.用户相关权限设置
security = user
passdb backend = tdbsam
[test]
comment = test directory
path =/test
writeanle = yes
browseable = no ##不显示test共享目录
匿名用户登陆
//172.25.254.108/test 10473900 3186684 7287216 31% /mnt
//172.25.254.108/test on /mnt type cifs (rw,relatime,vers=1.0,cache=strict,username=guest,domain=LOCALHOST,uid=0,noforceuid,gid=0,noforcegid,addr=172.25.254.108,unix,posixpaths,serverino,acl,rsize=1048576,wsize=65536,actimeo=1)
Sharename Type Comment
--------- ---- -------
mnt Disk mnt test directory
[[email protected] ~]# ll /mnt
total 0
-rw-r--r--. 1 root student 0 May 4 00:31 fire00
4.实现多用户挂载
安装 cifs-utils 软件
配置用户文件 vim /root/samba
查看帮助 man mount.cifs
多用户挂载 mount -o credentials=/root/samba,sec=ntlmssp,multiuer //172.25.254.108/test /mnt
此时root用户
[[email protected] ~]# cd /mnt/
[[email protected] mnt]# ls
file file123 filetest
[[email protected] mnt]# rm -fr file123
rm: cannot remove ‘file123’: Permission denied
[[email protected] mnt]# touch test
touch: cannot touch ‘test’: Permission denied
而普通用户
[[email protected] yum.repos.d]$ cd /mnt
[[email protected] mnt]$ ls
ls: reading directory .: Permission denied
普通用户认证 ##跟/test权限有关
[[email protected] mnt]$ cifscreds add -u tom 172.25.254.108
Password:
[[email protected] mnt]$ ls
file file123 filetest
[[email protected] mnt]$ rm -fr file
rm: cannot remove ‘file’: Permission denied
一、CIFS
1.CIFS系统：Internet文件共享系统，也称服务器信；适用于MicrosoftWindows服务器和客户端的标准文件和打印机的共享系统息块（SMB）
2.Samba服务：用于将linux文件系统作为CIFS/SMB网络文件进行共享，并将linux打印机作为CIFS/SMB打印机进行共享
二、Smb服务
1.安装smb服务
samba ##服务端
samba-common
samba-client
2.打开smb，列出共享文件系统信息
[[email protected] ~]# systemctl start smb
[[email protected] ~]# smbclient -L //172.25.254.108
Enter root's password:
Anonymous login successful
Domain=[MYGROUP] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
IPC$ IPC IPC Service (Samba Server Version 4.1.1)
Anonymous login successful
Domain=[MYGROUP] OS=[Unix] Server=[Samba 4.1.1]
Server Comment
--------- -------
Workgroup Master
--------- -------
3.设置默认域名 [global]
89 workgroup = WESTOS
90 server string = Samba Server Version %v
4.设置黑白名单 [global]
96 ; hosts allow = 172.25.254.8 172.25.254.108
97 ; hosts deny = 172.25.254.8 172.25.254.108
5.设置用户登陆 ##注意：必须是本地用户
[[email protected] ~]# useradd tom
[[email protected] ~]# useradd jerry
[[email protected] ~]# smbpasswd -a tom ##添加tom用户
New SMB password:
Retype new SMB password:
Added user tom.
[[email protected] ~]# smbpasswd -a jerry ##添加jerry用户
New SMB password:
Retype new SMB password:
Added user jerry.
[[email protected] ~]# pdbedit -L ##列出smb用户
tom:1001:
jerry:1002:
[[email protected] ~]# pdbedit -x jerry ##删除jerry用户
[[email protected] ~]# pdbedit -L
tom:1001:
6.使用用户登陆
[[email protected] ~]# smbclient -L //172.25.254.108 -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
IPC$ IPC IPC Service (Samba Server Version 4.1.1)
tom Disk Home Directories
三、Smb的Selinx保护
当Selinux=Disable时
1.进入用户家目录编辑
[[email protected] ~]# smbclient //172.25.254.108/tom -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls ##列出远程文件
. D 0 Thu May 3 21:46:28 2018
.. D 0 Thu May 3 21:46:34 2018
.bash_profile H 193 Wed Jan 29 07:45:18 2014
.mozilla DH 0 Thu Jul 10 18:29:32 2014
.config DH 0 Thu Jul 10 19:06:52 2014
.bashrc H 231 Wed Jan 29 07:45:18 2014
.bash_logout H 18 Wed Jan 29 07:45:18 2014
smb: \> !ls ##列出本地主机文件
anaconda-ks.cfg Documents Music Public Videos
Desktop Downloads Pictures Templates
smb: \> put anaconda-ks.cfg ##上传
putting file anaconda-ks.cfg as \anaconda-ks.cfg (8416.2 kb/s) (average 8417.0 kb/s)
smb: \> rm anaconda-ks.cfg ##删除
smb: \> ? ##列出smb可以使用的命令
? allinfo altname archive backup
blocksize cancel case_sensitive cd chmod
chown close del dir du
echo exit get getfacl geteas
2.挂载
[[email protected] ~]# mount -o username=tom,password=123 //172.25.254.108/tom /mnt
[[email protected] ~]# df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/vda1 10473900 3186240 7287660 31% /
devtmpfs 469344 0 469344 0% /dev
tmpfs 484932 140 484792 1% /dev/shm
tmpfs 484932 12828 472104 3% /run
tmpfs 484932 0 484932 0% /sys/fs/cgroup
/dev/mapper/vg0-vo 483670 2361 451818 1% /home
/dev/sr0 3654720 3654720 0 100% /run/media/root/RHEL-7.0 Server.x86_64
//172.25.254.108/tom 483670 2361 451818 1% /mnt
3.设置开机自动挂载
[[email protected] ~]# vim /etc/fstab
//172.25.254.108/tom /mnt cifs defaults,username=tom,password=123 0 0
当Selinux=Enforing时 ##注意：smb处于开启状态
samba_enable_home_dirs ##允许本地主目录作为CIFS文件共享
use_samba_home_dirs ##允许挂载远程CIFS文件共享并将其用作本地主目录
samba_share_t ##smb共享目录的selinux安全上下文
samba_export_all_ro ##共享目录只读
samba_export_all_rw ##允许共享目录读写
1.进入用户家目录编辑
[[email protected] ~]# smbclient //172.25.254.108/tom -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*
2.修改sebool值，进入用户家目录编辑
[[email protected] ~]# setsebool -P samba_enable_home_dirs on
[[email protected] ~]# smbclient //172.25.254.108/tom -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
. D 0 Thu May 3 21:49:51 2018
.. D 0 Thu May 3 21:46:34 2018
.bash_profile H 193 Wed Jan 29 07:45:18 2014
.mozilla DH 0 Thu Jul 10 18:29:32 2014
.config DH 0 Thu Jul 10 19:06:52 2014
.bashrc H 231 Wed Jan 29 07:45:18 2014
.bash_logout H 18 Wed Jan 29 07:45:18 2014
60458 blocks of size 8192. 56476 blocks available
3.共享目录
用户建立目录:
修改配置文件，共享tets目录
[[email protected] ~]# mkdir /test
[[email protected] ~]# vim /etc/samba/smb.conf
[test]
comment = test directory
path =/test
重启smb，可以看到test目录共享信息
[[email protected] ~]# systemctl restart smb.service
[[email protected] ~]# smbclient -L //172.25.254.108/
Enter root's password:
Anonymous login successful
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Co
mment
--------- ---- -------
test Disk test directory
IPC$ IPC IPC Service (Samba Server Version 4.1.1)
但是，tom用户登陆无法编辑
[[email protected] ~]# smbclient //172.25.254.108/test -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*
修改test目录的安全上下文，重启后再次登陆编辑
[[email protected] ~]# semanage fcontext -a -t samba_share_t '/test(/.*)?'
[[email protected] ~]# restorecon -RvvF /test/
restorecon reset /test context unconfined_u:object_r:default_t:s0->system_u:object_r:samba_share_t:s0
[[email protected] ~]# systemctl restart smb.service
[[email protected] ~]# smbclient //172.25.254.108/test -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
. D 0 Thu May 3 22:48:51 2018
.. D 0 Thu May 3 22:48:51 2018
系统目录：
修改配置文件，共享mnt系统目录
[[email protected] ~]# vim /etc/samba/smb.conf
[mnt]
comment = mnt test directory
path =/mnt
重启后查看共享目录信息
[[email protected] ~]# systemctl restart smb.service
[[email protected] ~]# smbclient -L //172.25.254.108/
Enter root's password:
Anonymous login successful
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
test Disk test directory
mnt Disk mnt test directory
IPC$ IPC IPC Service (Samba Server Version 4.1.1）
设定samba的sebool值，打开所有共享目录的读写权限
[[email protected] ~]# setsebool samba_export_all_rw 1
[[email protected] ~]# smbclient //172.25.254.108/mnt -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
. D 0 Thu May 11 20:23:52 2017
.. D 0 Thu May 3 22:48:51 2018
四、多用户挂载
1.指定用户具备读写权限
[[email protected] ~]# vim /etc/samba/smb.conf
[test]
comment = test directory
path =/test
write list =tom ##只有tom用户具备权限
##writable = yes ##所有用户具备权限
2.设定共享目录的读写权限，重启后测试
只有tom用户具备权限 注意 selinux的权限
[[email protected] ~]# mount //172.25.254.108/test /mnt -o username=tom,password=123
[[email protected] ~]# touch /mnt/file1
[[email protected] ~]# rm -rf /mnt/file1
挂载jerry用户，不具备权限
[[email protected] ~]# umount /mnt
[[email protected] ~]# mount //172.25.254.108/test /mnt -o username=jerry,password=123
[[email protected] ~]# touch /mnt/file2
touch: cannot touch ‘/mnt/file2’: Permission denied
3.用户相关权限设置
security = user
passdb backend = tdbsam
[test]
comment = test directory
path =/test
writeanle = yes
browseable = no ##不显示test共享目录
guest ok = yes ##允许匿名用户登陆
匿名用户登陆
//172.25.254.108/test 10473900 3186684 7287216 31% /mnt
//172.25.254.108/test on /mnt type cifs (rw,relatime,vers=1.0,cache=strict,username=guest,domain=LOCALHOST,uid=0,noforceuid,gid=0,noforcegid,addr=172.25.254.108,unix,posixpaths,serverino,acl,rsize=1048576,wsize=65536,actimeo=1)
不显示test共享目录，但是不影响使用
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
mnt Disk mnt test directory
IPC$ IPC IPC Service (Samba Server Version 4.1.1)
以student身份挂载，建立文件
[[email protected] ~]# mount //172.25.254.108/test /mnt -o username=student,password=123
[[email protected] ~]# touch /mnt/fire00
[[email protected] ~]# ll /mnt
total 0
-rw-r--r--. 1 root student 0 May 4 00:31 fire00
4.实现多用户挂载
[[email protected] ~]# cd /mnt/
[[email protected] mnt]# ls
file file123 filetest
[[email protected] mnt]# rm -fr file123
rm: cannot remove ‘file123’: Permission denied
[[email protected] mnt]# touch test
而普通用户
[[email protected] yum.repos.d]$ cd /mnt
[[email protected] mnt]$ ls
ls: reading directory .: Permission denied
普通用户认证 ##跟/test权限有关
[[email protected] mnt]$ cifscreds add -u tom 172.25.254.108
Password:
[[email protected] mnt]$ ls
file file123 filetest
[[email protected] mnt]$ rm -fr file
rm: cannot remove ‘file’: Permission denied
1.CIFS系统：Internet文件共享系统，也称服务器信；适用于MicrosoftWindows服务器和客户端的标准文件和打印机的共享系统息块（SMB）
2.Samba服务：用于将linux文件系统作为CIFS/SMB网络文件进行共享，并将linux打印机作为CIFS/SMB打印机进行共享
二、Smb服务
1.安装smb服务
samba-common
samba-client
2.打开smb，列出共享文件系统信息
[[email protected] ~]# systemctl start smb
[[email protected] ~]# smbclient -L //172.25.254.108
Anonymous login successful
Domain=[MYGROUP] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
IPC$ IPC IPC Service (Samba Server Version 4.1.1)
Anonymous login successful
Domain=[MYGROUP] OS=[Unix] Server=[Samba 4.1.1]
Server Comment
--------- -------
Workgroup Master
--------- -------
3.设置默认域名 [global]
89 workgroup = WESTOS
4.设置黑白名单 [global]
96 ; hosts allow = 172.25.254.8 172.25.254.108
97 ; hosts deny = 172.25.254.8 172.25.254.108
5.设置用户登陆 ##注意：必须是本地用户
[[email protected] ~]# useradd tom
[[email protected] ~]# useradd jerry
[[email protected] ~]# smbpasswd -a tom ##添加tom用户
Retype new SMB password:
Added user tom.
[[email protected] ~]# smbpasswd -a jerry ##添加jerry用户
Retype new SMB password:
Added user jerry.
[[email protected] ~]# pdbedit -L ##列出smb用户
tom:1001:
jerry:1002:
[[email protected] ~]# pdbedit -x jerry ##删除jerry用户
tom:1001:
6.使用用户登陆
[[email protected] ~]# smbclient -L //172.25.254.108 -U tom
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
IPC$ IPC IPC Service (Samba Server Version 4.1.1)
tom Disk Home Directories
三、Smb的Selinx保护
当Selinux=Disable时
1.进入用户家目录编辑
[[email protected] ~]# smbclient //172.25.254.108/tom -U tom
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls ##列出远程文件
.. D 0 Thu May 3 21:46:34 2018
.bash_profile H 193 Wed Jan 29 07:45:18 2014
.mozilla DH 0 Thu Jul 10 18:29:32 2014
.config DH 0 Thu Jul 10 19:06:52 2014
.bashrc H 231 Wed Jan 29 07:45:18 2014
.bash_logout H 18 Wed Jan 29 07:45:18 2014
smb: \> !ls ##列出本地主机文件
anaconda-ks.cfg Documents Music Public Videos
Desktop Downloads Pictures Templates
smb: \> put anaconda-ks.cfg ##上传
smb: \> rm anaconda-ks.cfg ##删除
smb: \> ? ##列出smb可以使用的命令
blocksize cancel case_sensitive cd chmod
chown close del dir du
echo exit get getfacl geteas
2.挂载
[[email protected] ~]# mount -o username=tom,password=123 //172.25.254.108/tom /mnt
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/vda1 10473900 3186240 7287660 31% /
devtmpfs 469344 0 469344 0% /dev
tmpfs 484932 140 484792 1% /dev/shm
tmpfs 484932 12828 472104 3% /run
tmpfs 484932 0 484932 0% /sys/fs/cgroup
/dev/mapper/vg0-vo 483670 2361 451818 1% /home
/dev/sr0 3654720 3654720 0 100% /run/media/root/RHEL-7.0 Server.x86_64
//172.25.254.108/tom 483670 2361 451818 1% /mnt
3.设置开机自动挂载
[[email protected] ~]# vim /etc/fstab
//172.25.254.108/tom /mnt cifs defaults,username=tom,password=123 0 0
当Selinux=Enforing时 ##注意：smb处于开启状态
use_samba_home_dirs ##允许挂载远程CIFS文件共享并将其用作本地主目录
samba_share_t ##smb共享目录的selinux安全上下文
samba_export_all_ro ##共享目录只读
samba_export_all_rw ##允许共享目录读写
1.进入用户家目录编辑
[[email protected] ~]# smbclient //172.25.254.108/tom -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*
2.修改sebool值，进入用户家目录编辑
[[email protected] ~]# setsebool -P samba_enable_home_dirs on
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
. D 0 Thu May 3 21:49:51 2018
.. D 0 Thu May 3 21:46:34 2018
.bash_profile H 193 Wed Jan 29 07:45:18 2014
.mozilla DH 0 Thu Jul 10 18:29:32 2014
.config DH 0 Thu Jul 10 19:06:52 2014
.bashrc H 231 Wed Jan 29 07:45:18 2014
.bash_logout H 18 Wed Jan 29 07:45:18 2014
60458 blocks of size 8192. 56476 blocks available
3.共享目录
用户建立目录:
修改配置文件，共享tets目录
[[email protected] ~]# mkdir /test
[[email protected] ~]# vim /etc/samba/smb.conf
comment = test directory
path =/test
重启smb，可以看到test目录共享信息
[[email protected] ~]# systemctl restart smb.service
[[email protected] ~]# smbclient -L //172.25.254.108/
Enter root's password:
Anonymous login successful
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
test Disk test directory
IPC$ IPC IPC Service (Samba Server Version 4.1.1)
但是，tom用户登陆无法编辑
[[email protected] ~]# smbclient //172.25.254.108/test -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*
修改test目录的安全上下文，重启后再次登陆编辑
[[email protected] ~]# semanage fcontext -a -t samba_share_t '/test(/.*)?'
restorecon reset /test context unconfined_u:object_r:default_t:s0->system_u:object_r:samba_share_t:s0
[[email protected] ~]# systemctl restart smb.service
[[email protected] ~]# smbclient //172.25.254.108/test -U tom
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
. D 0 Thu May 3 22:48:51 2018
.. D 0 Thu May 3 22:48:51 2018
系统目录：
修改配置文件，共享mnt系统目录
[[email protected] ~]# vim /etc/samba/smb.conf
[mnt]
comment = mnt test directory
path =/mnt
[[email protected] ~]# systemctl restart smb.service
[[email protected] ~]# smbclient -L //172.25.254.108/
Enter root's password:
Anonymous login successful
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
test Disk test directory
mnt Disk mnt test directory
IPC$ IPC IPC Service (Samba Server Version 4.1.1）
[[email protected] ~]# setsebool samba_export_all_rw 1
[[email protected] ~]# smbclient //172.25.254.108/mnt -U tom
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
. D 0 Thu May 11 20:23:52 2017
.. D 0 Thu May 3 22:48:51 2018
四、多用户挂载
1.指定用户具备读写权限
[[email protected] ~]# vim /etc/samba/smb.conf
[test]
comment = test directory
path =/test
write list =tom ##只有tom用户具备权限
##writable = yes ##所有用户具备权限
##write list [email protected] ##只有tom组的用户具备权限
2.设定共享目录的读写权限，重启后测试
[[email protected] ~]# chmod 777 /test/
[[email protected] ~]# systemctl restart smb.service
只有tom用户具备权限
[[email protected] ~]# mount //172.25.254.108/test /mnt -o username=tom,password=123
[[email protected] ~]# rm -rf /mnt/file1
挂载jerry用户，不具备权限
[[email protected] ~]# umount /mnt
[[email protected] ~]# mount //172.25.254.108/test /mnt -o username=jerry,password=123
[[email protected] ~]# touch /mnt/file2
touch: cannot touch ‘/mnt/file2’: Permission denied
3.用户相关权限设置
security = user
passdb backend = tdbsam
map to guest = bad user ##匿名用户映射为guest
[test]
comment = test directory
path =/test
writeanle = yes
browseable = no ##不显示test共享目录
guest ok = yes ##允许匿名用户登陆
admin users =student ##studet用户编辑时以root用户身份
匿名用户登陆
[[email protected] ~]# mount //172.25.254.108/test /mnt -o username=guest
//172.25.254.108/test 10473900 3186684 7287216 31% /mnt
//172.25.254.108/test on /mnt type cifs (rw,relatime,vers=1.0,cache=strict,username=guest,domain=LOCALHOST,uid=0,noforceuid,gid=0,noforcegid,addr=172.25.254.108,unix,posixpaths,serverino,acl,rsize=1048576,wsize=65536,actimeo=1)
不显示test共享目录，但是不影响使用
Sharename Type Comment
--------- ---- -------
mnt Disk mnt test directory
IPC$ IPC IPC Service (Samba Server Version 4.1.1)
[[email protected] ~]# mount //172.25.254.108/test /mnt -o username=student,password=123
[[email protected] ~]# ll /mnt
total 0
-rw-r--r--. 1 root student 0 May 4 00:31 fire00
4.实现多用户挂载
安装 cifs-utils 软件
配置用户文件 vim /root/samba
查看帮助 man mount.cifs
多用户挂载 mount -o credentials=/root/samba,sec=ntlmssp,multiuer //172.25.254.108/test /mnt
此时root用户
[[email protected] ~]# cd /mnt/
[[email protected] mnt]# ls
file file123 filetest
[[email protected] mnt]# rm -fr file123
rm: cannot remove ‘file123’: Permission denied
[[email protected] mnt]# touch test
touch: cannot touch ‘test’: Permission denied
而普通用户
[[email protected] yum.repos.d]$ cd /mnt
[[email protected] mnt]$ ls
ls: reading directory .: Permission denied
普通用户认证 ##跟/test权限有关
[[email protected] mnt]$ cifscreds add -u tom 172.25.254.108
Password:
[[email protected] mnt]$ ls
file file123 filetest
[[email protected] mnt]$ rm -fr file
rm: cannot remove ‘file’: Permission denied
一、CIFS
1.CIFS系统：Internet文件共享系统，也称服务器信；适用于MicrosoftWindows服务器和客户端的标准文件和打印机的共享系统息块（SMB）
2.Samba服务：用于将linux文件系统作为CIFS/SMB网络文件进行共享，并将linux打印机作为CIFS/SMB打印机进行共享
二、Smb服务
1.安装smb服务
samba ##服务端
samba-common
samba-client
2.打开smb，列出共享文件系统信息
[[email protected] ~]# systemctl start smb
[[email protected] ~]# smbclient -L //172.25.254.108
Enter root's password:
Anonymous login successful
Domain=[MYGROUP] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
IPC$ IPC IPC Service (Samba Server Version 4.1.1)
Anonymous login successful
Domain=[MYGROUP] OS=[Unix] Server=[Samba 4.1.1]
Server Comment
--------- -------
Workgroup Master
--------- -------
3.设置默认域名 [global]
89 workgroup = WESTOS
90 server string = Samba Server Version %v
4.设置黑白名单 [global]
96 ; hosts allow = 172.25.254.8 172.25.254.108
97 ; hosts deny = 172.25.254.8 172.25.254.108
5.设置用户登陆 ##注意：必须是本地用户
[[email protected] ~]# useradd tom
[[email protected] ~]# useradd jerry
[[email protected] ~]# smbpasswd -a tom ##添加tom用户
New SMB password:
Retype new SMB password:
Added user tom.
[[email protected] ~]# smbpasswd -a jerry ##添加jerry用户
New SMB password:
Retype new SMB password:
Added user jerry.
[[email protected] ~]# pdbedit -L ##列出smb用户
tom:1001:
jerry:1002:
[[email protected] ~]# pdbedit -x jerry ##删除jerry用户
[[email protected] ~]# pdbedit -L
tom:1001:
6.使用用户登陆
[[email protected] ~]# smbclient -L //172.25.254.108 -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
IPC$ IPC IPC Service (Samba Server Version 4.1.1)
tom Disk Home Directories
三、Smb的Selinx保护
当Selinux=Disable时
1.进入用户家目录编辑
[[email protected] ~]# smbclient //172.25.254.108/tom -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls ##列出远程文件
. D 0 Thu May 3 21:46:28 2018
.. D 0 Thu May 3 21:46:34 2018
.bash_profile H 193 Wed Jan 29 07:45:18 2014
.mozilla DH 0 Thu Jul 10 18:29:32 2014
.config DH 0 Thu Jul 10 19:06:52 2014
.bashrc H 231 Wed Jan 29 07:45:18 2014
.bash_logout H 18 Wed Jan 29 07:45:18 2014
smb: \> !ls ##列出本地主机文件
anaconda-ks.cfg Documents Music Public Videos
Desktop Downloads Pictures Templates
smb: \> put anaconda-ks.cfg ##上传
putting file anaconda-ks.cfg as \anaconda-ks.cfg (8416.2 kb/s) (average 8417.0 kb/s)
smb: \> rm anaconda-ks.cfg ##删除
smb: \> ? ##列出smb可以使用的命令
? allinfo altname archive backup
blocksize cancel case_sensitive cd chmod
chown close del dir du
echo exit get getfacl geteas
2.挂载
[[email protected] ~]# mount -o username=tom,password=123 //172.25.254.108/tom /mnt
[[email protected] ~]# df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/vda1 10473900 3186240 7287660 31% /
devtmpfs 469344 0 469344 0% /dev
tmpfs 484932 140 484792 1% /dev/shm
tmpfs 484932 12828 472104 3% /run
tmpfs 484932 0 484932 0% /sys/fs/cgroup
/dev/mapper/vg0-vo 483670 2361 451818 1% /home
/dev/sr0 3654720 3654720 0 100% /run/media/root/RHEL-7.0 Server.x86_64
//172.25.254.108/tom 483670 2361 451818 1% /mnt
3.设置开机自动挂载
[[email protected] ~]# vim /etc/fstab
//172.25.254.108/tom /mnt cifs defaults,username=tom,password=123 0 0
当Selinux=Enforing时 ##注意：smb处于开启状态
samba_enable_home_dirs ##允许本地主目录作为CIFS文件共享
use_samba_home_dirs ##允许挂载远程CIFS文件共享并将其用作本地主目录
samba_share_t ##smb共享目录的selinux安全上下文
samba_export_all_ro ##共享目录只读
samba_export_all_rw ##允许共享目录读写
1.进入用户家目录编辑
[[email protected] ~]# smbclient //172.25.254.108/tom -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*
2.修改sebool值，进入用户家目录编辑
[[email protected] ~]# setsebool -P samba_enable_home_dirs on
[[email protected] ~]# smbclient //172.25.254.108/tom -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
. D 0 Thu May 3 21:49:51 2018
.. D 0 Thu May 3 21:46:34 2018
.bash_profile H 193 Wed Jan 29 07:45:18 2014
.mozilla DH 0 Thu Jul 10 18:29:32 2014
.config DH 0 Thu Jul 10 19:06:52 2014
.bashrc H 231 Wed Jan 29 07:45:18 2014
.bash_logout H 18 Wed Jan 29 07:45:18 2014
60458 blocks of size 8192. 56476 blocks available
3.共享目录
用户建立目录:
修改配置文件，共享tets目录
[[email protected] ~]# mkdir /test
[[email protected] ~]# vim /etc/samba/smb.conf
[test]
comment = test directory
path =/test
重启smb，可以看到test目录共享信息
[[email protected] ~]# systemctl restart smb.service
[[email protected] ~]# smbclient -L //172.25.254.108/
Enter root's password:
Anonymous login successful
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Co
--------- ---- -------
test Disk test directory
IPC$ IPC IPC Service (Samba Server Version 4.1.1)
但是，tom用户登陆无法编辑
[[email protected] ~]# smbclient //172.25.254.108/test -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*
修改test目录的安全上下文，重启后再次登陆编辑
[[email protected] ~]# semanage fcontext -a -t samba_share_t '/test(/.*)?'
[[email protected] ~]# restorecon -RvvF /test/
restorecon reset /test context unconfined_u:object_r:default_t:s0->system_u:object_r:samba_share_t:s0
[[email protected] ~]# systemctl restart smb.service
[[email protected] ~]# smbclient //172.25.254.108/test -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
. D 0 Thu May 3 22:48:51 2018
.. D 0 Thu May 3 22:48:51 2018
系统目录：
修改配置文件，共享mnt系统目录
[[email protected] ~]# vim /etc/samba/smb.conf
[mnt]
comment = mnt test directory
path =/mnt
重启后查看共享目录信息
[[email protected] ~]# systemctl restart smb.service
[[email protected] ~]# smbclient -L //172.25.254.108/
Enter root's password:
Anonymous login successful
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
test Disk test directory
mnt Disk mnt test directory
IPC$ IPC IPC Service (Samba Server Version 4.1.1）
设定samba的sebool值，打开所有共享目录的读写权限
[[email protected] ~]# setsebool samba_export_all_rw 1
[[email protected] ~]# smbclient //172.25.254.108/mnt -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
. D 0 Thu May 11 20:23:52 2017
.. D 0 Thu May 3 22:48:51 2018
四、多用户挂载
1.指定用户具备读写权限
[[email protected] ~]# vim /etc/samba/smb.conf
[test]
comment = test directory
path =/test
write list =tom ##只有tom用户具备权限
##writable = yes ##所有用户具备权限
##write list [email protected] ##只有tom组的用户具备权限
2.设定共享目录的读写权限，重启后测试
[[email protected] ~]# chmod 777 /test/
只有tom用户具备权限 注意 selinux的权限
[[email protected] ~]# mount //172.25.254.108/test /mnt -o username=tom,password=123
[[email protected] ~]# touch /mnt/file1
[[email protected] ~]# rm -rf /mnt/file1
挂载jerry用户，不具备权限
[[email protected] ~]# umount /mnt
[[email protected] ~]# mount //172.25.254.108/test /mnt -o username=jerry,password=123
[[email protected] ~]# touch /mnt/file2
touch: cannot touch ‘/mnt/file2’: Permission denied
3.用户相关权限设置
security = user
passdb backend = tdbsam
map to guest = bad user ##匿名用户映射为guest
[test]
comment = test directory
path =/test
writeanle = yes
browseable = no ##不显示test共享目录
guest ok = yes ##允许匿名用户登陆
admin users =student ##studet用户编辑时以root用户身份
匿名用户登陆
[[email protected] ~]# mount //172.25.254.108/test /mnt -o username=guest
//172.25.254.108/test 10473900 3186684 7287216 31% /mnt
//172.25.254.108/test on /mnt type cifs (rw,relatime,vers=1.0,cache=strict,username=guest,domain=LOCALHOST,uid=0,noforceuid,gid=0,noforcegid,addr=172.25.254.108,unix,posixpaths,serverino,acl,rsize=1048576,wsize=65536,actimeo=1)
不显示test共享目录，但是不影响使用
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
mnt Disk mnt test directory
IPC$ IPC IPC Service (Samba Server Version 4.1.1)
以student身份挂载，建立文件
[[email protected] ~]# mount //172.25.254.108/test /mnt -o username=student,password=123
[[email protected] ~]# touch /mnt/fire00
[[email protected] ~]# ll /mnt
total 0
-rw-r--r--. 1 root student 0 May 4 00:31 fire00
4.实现多用户挂载
安装 cifs-utils 软件
配置用户文件 vim /root/samba
多用户挂载 mount -o credentials=/root/samba,sec=ntlmssp,multiuer //172.25.254.108/test /mnt
[[email protected] ~]# cd /mnt/
[[email protected] mnt]# ls
file file123 filetest
[[email protected] mnt]# rm -fr file123
rm: cannot remove ‘file123’: Permission denied
[[email protected] mnt]# touch test
touch: cannot touch ‘test’: Permission denied
而普通用户
[[email protected] yum.repos.d]$ cd /mnt
[[email protected] mnt]$ ls
ls: reading directory .: Permission denied
普通用户认证 ##跟/test权限有关
[[email protected] mnt]$ cifscreds add -u tom 172.25.254.108
Password:
[[email protected] mnt]$ ls
file file123 filetest
[[email protected] mnt]$ rm -fr file
rm: cannot remove ‘file’: Permission denied