samba的从无到有

摘要: Linux samba 服务配置

　一、samba简介

Samba是一个能让Linux系统应用Microsoft网络通讯协议的软件，而SMB是Server Message Block的缩写，即为服务器消息块 ，SMB主要是作为Microsoft的网络通讯协议，后来Samba将SMB通信协议应用到了Linux系统上，就形成了现在的Samba软件。

　Samba最大的功能就是可以用于Linux与windows系统直接的文件共享和打印共享，Samba既可以用于windows与Linux 之间的文件共享，也可以用于Linux与Linux之间的资源共享，由于NFS(网络文件系统）可以很好的完成Linux与Linux之间的数据共享，因 而 Samba较多的用在了Linux与windows之间的数据共享上面。

二、系统环境

系统平台：CentOS release 6.3 (Final)

Samba版本：samba-3.5.10-125.el6.x86_64

Samba Server IP：192.168.0.164

防火墙已关闭/iptables: Firewall is not running.

SELINUX=disabled

三、samba安装

前提 ： 虚拟机必须调成桥接模式（必须能够访问外网）

1、卸载samba

# rpm -qa | grep samba //查看samba服务包

# rpm -e samba //卸载指定samba服务包

# rpm -e --nodeps samba-common-2.2.7 //强制卸载指定samba服务包

清除samba服务列表，为了能够那更好的安装samba。

2、安装samba

# yum install samba samba-client samba-swat

安装samba所需服务。

注：如若使用yum不能安装，执行命令 # clean yum all,然后再次安装samba。

如果死活还是安装不上，报错如下：

GPG key retrieval failed: [Errno 14] Could not open/read

file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle

下面有猛药：

删除/etc/yum.repos.d/下面的public-yum-ol6.repo

3、系统配置

1）、Samba设置成开机自启动

# chkconfig --level 35 smb on

查看samba设置开机状态

# chkconfig --list smb

2）Samba 的端口设置为开启

# vi /etc/sysconfig/iptables

-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT ←找到此行，在下面添加如下行：

-A INPUT -m state --state NEW -m udp -p udp --dport 137 -j ACCEPT

-A INPUT -m state --state NEW -m udp -p udp --dport 138 -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT

# /etc/rc.d/init.d/iptables restart　←重新启动iptables ，使新的规则生效

3）、centos内置selinux让samba可以访问目录

# setenforce 0

四、配置Samba服务

Samba的主配置文件为/etc/samba/smb.conf

主配置文件由两部分构成

· Global Settings (55-245行)

　　该设置都是与Samba服务整体运行环境有关的选项，它的设置项目是针对所有共享资源的。

· Share Definitions （246-尾行）

该设置针对的是共享目录个别的设置，只对当前的共享资源起作用。

注：下文中#与;代表注释的意识 ，绿色部分（必须项）为添加修改项，其他参数自行研究

#======================= Global Settings =====================================

[global]

# ----------------------- Network Related Options -------------------------

#

# workgroup = NT-Domain-Name or Workgroup-Name, eg: MIDEARTH

#

# server string is the equivalent of the NT Description field

#

# netbios name can be used to specify a server name not tied to the hostname

#

# Interfaces lets you configure Samba to use multiple interfaces

# If you have multiple network interfaces then you can list the ones

# you want to listen on (never omit localhost)

#

# Hosts Allow/Hosts Deny lets you restrict who can connect, and you can

# specifiy it as a per share option as well

#

workgroup = WORKGROUP <-----与windows系统工作组一致（默认）

server string = Samba Server Version %v

;netbios name = MYSERVER

;interfaces = lo eth0 192.168.12.2/24 192.168.13.2/24

hosts allow = 127. 192.168.0. 192.168.188.<-----允许访问的Windows系统网段

# --------------------------- Logging Options -----------------------------

#

# Log File let you specify where to put logs and how to split them up.

#

# Max Log Size let you specify the max size log files should reach

# logs split per machine

log file = /var/log/samba/log.%m

# max 50KB per log file, then rotate

max log size = 50

# ----------------------- Standalone Server Options ------------------------

#

# Scurity can be set to user, share(deprecated) or server(deprecated)

#

# Backend to store user information in. New installations should

# use either tdbsam or ldapsam. smbpasswd is available for backwards

# compatibility. tdbsam requires no further configuration.

security = user <------常用user和share两种方式，user 需要用户和密码访问。Share无需用户密码。

passdb backend = tdbsam

# ----------------------- Domain Members Options ------------------------

#

# Security must be set to domain or ads

#

# Use the realm option only with security = ads

# Specifies the Active Directory realm the host is part of

#

# Backend to store user information in. New installations should

# use either tdbsam or ldapsam. smbpasswd is available for backwards

# compatibility. tdbsam requires no further configuration.

#

# Use password server option only with security = server or if you can't

# use the DNS to locate Domain Controllers

# The argument list may include:

# password server = My_PDC_Name [My_BDC_Name] [My_Next_BDC_Name]

# or to auto-locate the domain controller/s

# password server = *

;security = domain

;passdb backend = tdbsam

;realm = MY_REALM

;password server = <NT-Server-Name>

# ----------------------- Domain Controller Options ------------------------

#

# Security must be set to user for domain controllers

#

# Backend to store user information in. New installations should

# use either tdbsam or ldapsam. smbpasswd is available for backwards

# compatibility. tdbsam requires no further configuration.

#

# Domain Master specifies Samba to be the Domain Master Browser. This

# allows Samba to collate browse lists between subnets. Don't use this

# if you already have a Windows NT domain controller doing this job

#

# Domain Logons let Samba be a domain logon server for Windows workstations.

#

# Logon Scrpit let yuou specify a script to be run at login time on the client

# You need to provide it in a share called NETLOGON

#

# Logon Path let you specify where user profiles are stored (UNC path)

#

# Various scripts can be used on a domain controller or stand-alone

# machine to add or delete corresponding unix accounts

#

;security = user

;passdb backend = tdbsam

;domain master = yes

;domain logons = yes

# the login script name depends on the machine name

;logon script = %m.bat

# the login script name depends on the unix user used

;logon script = %u.bat

;logon path = \\%L\Profiles\%u

# disables profiles support by specifing an empty path

;logon path =

;add user script = /usr/sbin/useradd "%u" -n -g users

;add group script = /usr/sbin/groupadd "%g"

;add machine script = /usr/sbin/useradd -n -c "Workstation (%u)" -M -d /nohome -s /bin/false "%u"

;delete user script = /usr/sbin/userdel "%u"

;delete user from group script = /usr/sbin/userdel "%u" "%g"

;delete group script = /usr/sbin/groupdel "%g"

# ----------------------- Browser Control Options ----------------------------

#

# set local master to no if you don't want Samba to become a master

# browser on your network. Otherwise the normal election rules apply

#

# OS Level determines the precedence of this server in master browser

# elections. The default value should be reasonable

#

# Preferred Master causes Samba to force a local browser election on startup

# and gives it a slightly higher chance of winning the election

;local master = no

;os level = 33

;preferred master = yes

#----------------------------- Name Resolution -------------------------------

# Windows Internet Name Serving Support Section:

# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both

#

# - WINS Support: Tells the NMBD component of Samba to enable it's WINS Server

#

# - WINS Server: Tells the NMBD components of Samba to be a WINS Client

#

# - WINS Proxy: Tells Samba to answer name resolution queries on

# behalf of a non WINS capable client, for this to work there must be

# at least oneWINS Server on the network. The default is NO.

#

# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names

# via DNS nslookups.

;wins support = yes

;wins server = w.x.y.z

;wins proxy = yes

;dns proxy = yes

# --------------------------- Printing Options -----------------------------

#

# Load Printers let you load automatically the list of printers rather

# than setting them up individually

#

# Cups Options let you pass the cups libs custom options, setting it to raw

# for example will let you use drivers on your Windows clients

#

# Printcap Name let you specify an alternative printcap file

#

# You can choose a non default printing system using the Printing option

load printers = yes

cups options = raw

;printcap name = /etc/printcap

#obtain list of printers automatically on SystemV

;printcap name = lpstat

;printing = cups

# --------------------------- Filesystem Options ---------------------------

#

# The following options can be uncommented if the filesystem supports

# Extended Attributes and they are enabled (usually by the mount option

# user_xattr). Thess options will let the admin store the DOS attributes

# in an EA and make samba not mess with the permission bits.

#

# Note: these options can also be set just per share, setting them in global

# makes them the default for all shares

;map archive = no

;map hidden = no

;map read only = no

;map system = no

;store dos attributes = yes

#============================ Share Definitions ==============================

[homes]

comment = Home Directories

browseable = no

writable = yes

;valid users = %S

;valid users = MYDOMAIN\%S

[public] //共性目录别名

comment = Public Stuff //注释

path = /home/share/ // 共享目录

public = yes //共性目录是否公开

writable=yes //可写

valid user =test,xyz //只允许test和xyz两个samba用户访问

[Share]

comment = This is a share directory.

path = /home/Company/Share/

public = no

admin users = admin //目录所有者

valid users = admin,@hradmin,@fmadmin //只允许admin用户和hradmin、fmadmin组用户访问 ，组用户前加@符多个使用“，”隔开。

writable = yes

create mask = 0755 //默认创建的文件权限755。

directory mask = 0755 //默认创建的目录全向755。

[printers]

comment = All Printers

path = /var/spool/samba

browseable = no

guest ok = no

writable = no

printable = yes

# Un-comment the following and create the netlogon directory for Domain Logons

;[netlogon]

;comment = Network Logon Service

;path = /var/lib/samba/netlogon

;guest ok = yes

;writable = no

;share modes = no

# Un-comment the following to provide a specific roving profile share

# the default is to use the user's home directory

;[Profiles]

;path = /var/lib/samba/profiles

;browseable = no

;guest ok = yes

# A publicly accessible directory, but read only, except for people in

# the "staff" group

;[public]

;comment = Public Stuff

;path = /home/samba

;public = yes

;writable = yes

;printable = no

;write list = +staff

五、牛刀小试

1、要求：创建一个共享目录（share），任何人都可访问。

1）、修改smb.conf

# vi /etc/samba/smb.conf

修改和添加内容

workgroup = WORKGROUP

security =share

hosts allow = 127. 192.168.0. 192.168.188. //按需修改

在末尾处添加

[public]

comment = Public Stuff

path = /home/share/

public = yes

writable=yes

：wq保存smb.conf

2）、创建共享目录

# mkdir -p /home/share

3）、启动服务

# service smb start

# service nmb start

# service iptables stop

4）、查看共享文件

Win+R \\192.168.0.164\

2、要求：创建一个共享目录（myWork），只允许指定的人和组可看。

1）、修改smb.conf

# vi /etc/samba/smb.conf

修改和添加内容

workgroup = WORKGROUP

security =user

hosts allow = 127. 192.168.0. 192.168.188. //按需修改

在末尾处添加

[work]

comment = Public Stuff

path = /home/myWork/

public = no

writable=yes

valid users=test,@xyz

：wq保存smb.conf

2）、创建共享目录

# mkdir -p /home/myWork/

3）、启动服务

# service smb reload

4）、查看共享文件

Win+R \\192.168.0.164\

六、分享时刻

Win+R \\192.168.0.164\

1、如果弹不出共享目录框，死活就是出不来。

解：关闭防火墙 # service iptables stop

Samba 重启服务 # service smb restart

2、如下图



解：打开dos窗口

Win+R cmd

输入： net use //查询当前连接的samba

net use * /del 删除当前的远程连接

稍等片刻再去连接。

3、如下图



解：出现上面的问题快速的解决办法，更改一下samba ServerIP

# vi /etc/sysconfig/network-scripts/ifcfg-eth0

修改 IPADDR 换个IP就可以啦

4、已经修改成桥接模式，IP已设置成功，就是连接不成功外网。

解：这是一副很强的猛药，一剂见效。

在虚拟机的界面：编辑---->虚拟网络编辑器---->更改设置----->还原默认设置----->ok

只要ping不通外网，samba共享就不能连接。