Linux SAMBA服务器配置共享目录，访问控制，用户映射

Posted 2023-02-19

1、操作条件
（1）已经安装Linux操作系统的PC
（2）已经安装SAMBA服务器
（3）已经存在财务部和销售部的共享目录，分别为/var/samba/finance和/var/samba/sales目录
（4）系统中存在finance用户组和sales用户组
（5）假设在本单元内的Windows2003计算机上已有销售部职员zhangy和lixy两个帐号

2、操作内容
某公司需要配置SAMBA服务，配置安全级别为user，然后设置共享目录/var/samba/finance和/var/samba/sales，共享名分别为finance和sales，分别用于财务部和销售部的共享目录，并且每个目录都只能是本部门员工可以使用。另外，设置SAMBA服务只在本地网段提供（192.168.1.0/24）。最后分别为finance用户组的成员jack和mary以及sales用户组的成员john和sally建立帐号，并设置登录口令。作为管理员，需要做以下工作：
（1）设置共享目录/var/samba/finance，只有finance用户组可以访问。
（2）设置共享目录/var/samba/sales，只有sales用户组可以访问。
（3）设置访问控制，只有192.168.1.0/24可以访问。
（4）添加用户jack、mary、john和sally到samba用户文件，并设置口令使其能正确访问SAMBA服务器，口令分别为jack1234、mary1234、john1234和sally1234。
（5）假设本单元内的Windows 2003计算机上已有销售部职员zhangy和lixy两个帐号，现在希望这两个用户可以在访问Samba服务器上的共享资源时，可直接使用自己的Windows帐号进行访问。

3、操作要求
（1）设置共享目录/var/samba/finance，只允许finance用户组可以访问。
（2）设置共享目录/var/samba/sales，只允许sales用户组可以访问。
（3）设置访问控制，只有192.168.1.0/24可以访问。
（4）添加用户jack、mary、john和sally到samba用户文件，并设置口令使其能正确访问SAMBA服务器。
（5）能够设置用户映射。

参考技术A [global]

# ----------------------- Network Related Options-------------------------
#
# workgroup = NT-Domain-Name or Workgroup-Name, eg: MIDEARTH
#
# server string is the equivalent of the NT Description field
#
# netbios name can be used to specify a server name not tied to thehostname
#
# Interfaces lets you configure Samba to use multiple interfaces
# If you have multiple network interfaces then you can list the ones
# you want to listen on (never omit localhost)
#
# Hosts Allow/Hosts Deny lets you restrict who can connect, and you can
# specifiy it as a per share option as well
#
workgroup = MYGROUP
server string = Samba Server Version%v

; netbios name = MYSERVER

interfaces = lo eth0
hosts allow = 192.168.1.
user map =/etc/samba/smbusermap

# --------------------------- Logging Options-----------------------------
#
# Log File let you specify where to put logs and how to split them up.
#
# Max Log Size let you specify the max size log files should reach

# logs split per machine
log file = /var/log/samba/log.%m
# max 50KB per log file, thenrotate
max log size = 50

# ----------------------- Standalone Server Options------------------------
#
# Scurity can be set to user, share(deprecated) or server(deprecated)
#
# Backend to store user information in. New installations should
# use either tdbsam or ldapsam. smbpasswd is available for backwards
# compatibility. tdbsam requires no further configuration.

security = user
passdb backend = tdbsam

# ----------------------- Domain Members Options ------------------------
#
# Security must be set to domain or ads
#
# Use the realm option only with security = ads
# Specifies the Active Directory realm the host is part of
#
# Backend to store user information in. New installations should
# use either tdbsam or ldapsam. smbpasswd is available for backwards
# compatibility. tdbsam requires no further configuration.
#
# Use password server option only with security = server or if you can't
# use the DNS to locate Domain Controllers
# The argument list may include:
# password server = My_PDC_Name[My_BDC_Name] [My_Next_BDC_Name]
# or to auto-locate the domain controller/s
# password server = *

; security = domain
; passdb backend = tdbsam
; realm = MY_REALM

; password server =<NT-Server-Name>

# ----------------------- Domain Controller Options------------------------
#
# Security must be set to user for domain controllers
#
# Backend to store user information in. New installations should
# use either tdbsam or ldapsam. smbpasswd is available for backwards
# compatibility. tdbsam requires no further configuration.
#
# Domain Master specifies Samba to be the Domain Master Browser. This
# allows Samba to collate browse lists between subnets. Don't use this
# if you already have a Windows NT domain controller doing this job
#
# Domain Logons let Samba be a domain logon server for Windows workstations.
#
# Logon Scrpit let yuou specify a script to be run at login time on theclient
# You need to provide it in a share called NETLOGON
#
# Logon Path let you specify where user profiles are stored (UNC path)
#
# Various scripts can be used on a domain controller or stand-alone
# machine to add or delete corresponding unix accounts
#
; security = user
; passdb backend = tdbsam

; domain master = yes
; domain logons = yes

# the login script name depends on themachine name
; logon script = %m.bat
# the login script name depends on theunix user used
; logon script = %u.bat
; logon path = \\%L\Profiles\%u
# disables profiles support byspecifing an empty path
; logon path =

; add user script = /usr/sbin/useradd"%u" -n -g users
; add group script = /usr/sbin/groupadd"%g"
; add machine script = /usr/sbin/useradd-n -c "Workstation (%u)" -M -d /nohome -s /bin/false"%u"
; delete user script = /usr/sbin/userdel"%u"
; delete user from group script =/usr/sbin/userdel "%u" "%g"
; delete group script =/usr/sbin/groupdel "%g"

# ----------------------- Browser Control Options----------------------------
#
# set local master to no if you don't want Samba to become a master
# browser on your network. Otherwise the normal election rules apply
#
# OS Level determines the precedence of this server in master browser
# elections. The default value should be reasonable
#
# Preferred Master causes Samba to force a local browser election onstartup
# and gives it a slightly higher chance of winning the election
; local master = no
; os level = 33
; preferred master = yes

#----------------------------- Name Resolution -------------------------------
# Windows Internet Name Serving Support Section:
# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
#
# - WINS Support: Tells the NMBD component of Samba to enable it's WINSServer
#
# - WINS Server: Tells the NMBD components of Samba to be a WINS Client
#
# - WINS Proxy: Tells Samba to answer name resolution queries on
# behalf of a non WINS capable client,for this to work there must be
# at least one WINS Server on the network. The default is NO.
#
# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
# via DNS nslookups.

; wins support = yes
; wins server = w.x.y.z
; wins proxy = yes

; dns proxy = yes

# --------------------------- Printing Options-----------------------------
#
# Load Printers let you load automatically the list of printers rather
# than setting them up individually
#
# Cups Options let you pass the cups libs custom options, setting it toraw
# for example will let you use drivers on your Windows clients
#
# Printcap Name let you specify an alternative printcap file
#
# You can choose a non default printing system using the Printing option

load printers = no
cups options = raw

; printcap name = /etc/printcap
#obtain list of printers automaticallyon SystemV
; printcap name = lpstat
; printing = cups

# --------------------------- Filesystem Options---------------------------
#
# The following options can be uncommented if the filesystem supports
# Extended Attributes and they are enabled (usually by the mount option
# user_xattr). Thess options will let the admin store the DOS attributes
# in an EA and make samba not mess with the permission bits.
#
# Note: these options can also be set just per share, setting them inglobal
# makes them the default for all shares

; map archive = no
; map hidden = no
; map read only = no
; map system = no
; store dos attributes = yes

#============================ Share Definitions==============================

[homes]
comment = Home Directories
browseable = no
writable = yes
; valid users = %S
; valid users = MYDOMAIN\%S

[sales]
comment = Home Directories
path=/var/samba/sales
browseable = no
writable = yes
; valid users = %S
; valid users = MYDOMAIN\%S

[finance]
comment = Home Directories
browseable = yes
path=/var/samba/finance
writable = yes
; valid users = %S
; valid users = MYDOMAIN\%S

[printers]
comment = All Printers
path = /var/spool/samba
browseable = no
guest ok = no
writable = no
printable = yes

# Un-comment the following and create the netlogon directory for DomainLogons
; [netlogon]
; comment = Network Logon Service
; path = /var/lib/samba/netlogon
; guest ok = yes
; writable = no
; share modes = no

# Un-comment the following to provide a specific roving profile share
# the default is to use the user's home directory
; [Profiles]
; path = /var/lib/samba/profiles
; browseable = no
; guest ok = yes

# A publicly accessible directory, but read only, except for people in
# the "staff" group
; [public]
; comment = Public Stuff
; path = /home/samba
; public = yes
; writable = yes
; printable = no
; write list = +staff

以上是smb.conf内的配置。
增加用户和组，并设置好用户组的隶属关系。
用smbpasswd -a 增加smb访问密码。本回答被提问者和网友采纳