特点：支持跨平台的文件共享
增加了一些访问控制，权限
samba-client.i386
samba-common.i386
samba.i386
配置目录： /etc/samba
配置文件： smb.conf
[global]
workgroup = MYGROUP
server string = Samba Server Version %v
# logs split per machine
# max 50KB per log file, then rotate
security = user <-- share,server,ads,domain
passdb backend = tdbsam
# the login script name depends on the machine name
# the login script name depends on the unix user used
# disables profiles support by specifing an empty path
load printers = yes
cups options = raw
#obtain list of printers automatically on SystemV
[homes]
comment = Home Directories
browseable = no <--匿名扫描或者别的帐号扫描是不能看到该资源
writable = yes <--可写
[printers]
comment = All Printers
path = /var/spool/samba
browseable = no
guest ok = no
writable = no
printable = yes
一、安装
[root@www ~]# yum install samba* -y
Loaded plugins: rhnplugin, security
This system is not registered with RHN.
RHN support will be disabled.
Setting up Install Process
Parsing package install arguments
Resolving Dependencies
--> Running transaction check
---> Package samba-client.i386 0:3.0.33-3.14.el5 set to be updated
---> Package samba-common.i386 0:3.0.33-3.14.el5 set to be updated
---> Package samba-swat.i386 0:3.0.33-3.14.el5 set to be updated
---> Package samba.i386 0:3.0.33-3.14.el5 set to be updated
--> Processing Dependency: perl(Convert::ASN1) for package: samba
--> Running transaction check
---> Package perl-Convert-ASN1.noarch 0:0.20-1.1 set to be updated
--> Finished Dependency Resolution
Dependencies Resolved
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
samba i386 3.0.33-3.14.el5 rhel-debuginfo 16 M
samba-swat i386 3.0.33-3.14.el5 rhel-debuginfo 8.2 M
Updating:
samba-client i386 3.0.33-3.14.el5 rhel-debuginfo 5.7 M
samba-common i386 3.0.33-3.14.el5 rhel-debuginfo 8.7 M
Installing for dependencies:
perl-Convert-ASN1 noarch 0.20-1.1 rhel-debuginfo 41 k
Transaction Summary
================================================================================
Install 3 Package(s)
Update 2 Package(s)
Remove 0 Package(s)
Total download size: 39 M
Downloading Packages:
(1/5): perl-Convert-ASN1-0.20-1.1.noarch.rpm | 41 kB 00:00
(2/5): samba-client-3.0.33-3.14.el5.i386.rpm | 5.7 MB 00:01
(3/5): samba-swat-3.0.33-3.14.el5.i386.rpm | 8.2 MB 00:01
(4/5): samba-common-3.0.33-3.14.el5.i386.rpm | 8.7 MB 00:02
(5/5): samba-3.0.33-3.14.el5.i386.rpm | 16 MB 00:03
--------------------------------------------------------------------------------
Total 3.8 MB/s | 39 MB 00:10
Running rpm_check_debug
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
Updating : samba-common [1/7]
Updating : samba-client [2/7]
Installing : perl-Convert-ASN1 [3/7]
Installing : samba [4/7]
Installing : samba-swat [5/7]
Cleanup : samba-client [6/7]
Cleanup : samba-common [7/7]
Installed: samba.i386 0:3.0.33-3.14.el5 samba-swat.i386 0:3.0.33-3.14.el5
Dependency Installed: perl-Convert-ASN1.noarch 0:0.20-1.1
Updated: samba-client.i386 0:3.0.33-3.14.el5 samba-common.i386 0:3.0.33-3.14.el5
Complete!
You have new mail in /var/spool/mail/root
二、配置共享文件
Samba服务器使用的帐号的是系统必须存在的帐号，但帐号的密码是samba独立
[root@www ~]# useradd wych
You have new mail in /var/spool/mail/root
[root@www ~]# passwd wych
Changing password for user wych.
New UNIX password:
BAD PASSWORD: it is WAY too short
Retype new UNIX password:
passwd: all authentication tokens updated successfully.
[root@www ~]# servce smb restart
-bash: servce: command not found
[root@www ~]# service smb restart
Shutting down SMB services: [FAILED]
Shutting down NMB services: [FAILED]
Starting SMB services: [ OK ]
Starting NMB services: [ OK ]
[root@www ~]# service smb restart
[root@www ~]# useradd wych
You have new mail in /var/spool/mail/root
[root@www ~]# passwd wych
Changing password for user wych.
New UNIX password:
BAD PASSWORD: it is WAY too short
Retype new UNIX password:
passwd: all authentication tokens updated successfully.
[root@www ~]# smbpasswd wych
New SMB password:
Retype new SMB password:
Failed to find entry for user wych.
Failed to modify password entry for user wych
You have new mail in /var/spool/mail/root
例子1：
Samba服务器使用的帐号的是系统必须存在的帐号，但帐号的密码是samba独立
[root@squid conf]# smbpasswd -a tom
New SMB password:
Retype new SMB password:
Added user tom.
[root@squid conf]# smbpasswd -a bean
New SMB password:
Retype new SMB password:
Added user bean.
Service smb restart
匿名扫描
smbclient -L //10.1.1.21
使用某个帐号列出资源
# smbclient -L //10.1.1.21 -U tom
访问资源
smbclient //10.1.1.21/bean -U bean
例子2:增加自定义共享
[uplooking]
comment = Just for test
path = /www
browseable = yes
guest ok = no
writable = no
# smbclient //10.1.1.21/uplooking
Password:
Anonymous login successful
Domain=[MYGROUP] OS=[Unix] Server=[Samba 3.0.33-3.7.el5]
tree connect failed: NT_STATUS_ACCESS_DENIED
# smbclient //10.1.1.21/uplooking -U tom
在user模式下，把资源让匿名可以访问，资源可写
public = yes 《－－ guest ok =yes
read only = no <--- writeable = yes
在windows下访问的格式
//10.1.1.21/uplooking
关闭已经建立好的资源访问
net use * /del /y
在user模式下，就算是访问匿名资源也必须提供帐号，所以说，不能访问
更改成share模式之后：
security = share
例子3：关于可写资源文件的权限问题
使用两个独立帐号分别上传文件，发现可以相互删除，原因：只要拥有者对文件有写的权限，其他帐号就可以对它进行删除。
怎么去解决？让别人不能随便删除其他的文件。
对资源目录设定stick bit
chmod o+t /www
第2种办法：
让文件上传之后，自动去掉拥有者写权限
create mask = 0444 <--对于这样的权限，拥有者也不能删除自己的文件
directory mask = 0755
例子4: 访问控制，必须把级别改成user
控制资源参数
write list = tom <--如果存在read only = no 那么write list失效
valid users = tom,bean <--- invalid users =
控制访问来源
hosts deny = 10.1.1.
hosts allow = 10.1.1.20 《－－只允许10.1.1.20访问，别的都拒绝
总结：当deny和allow重叠的时候，allow说了算。
实现拒绝所有人访问，但是10.1.1.0/24可以访问,但是10.1.1.20不允访问
hosts deny = all
hosts allow = 10.1.1. EXCEPT 10.1.1.20
如果使用域名来实现，那么必须DNS支持正向和方向解析
hosts allow = .upl.com
例子5： 在user模式下，实现tom可以上传下载，bean只能下载，其他用户不能登录，拒绝匿名访问。
valid users = tom,bean
guest ok = no
write list = tom
read list = bean <---可选