Samba file server user permissions model complex design and implementation of

1, Introduction;


Linux is extremely powerful desktop environment, if the desktop environment, the little mouse, there is able to resolve almost all issues of the server set up. Competence model for complex Samba file server, or do not quite understand something. Let me use a few words in this article. Although the Samba file server documents are piling up, but I can be counted as of this writing skills or tips, perhaps a bit with a number of brothers; master to拍砖, I opened the door welcome ~

If you are a Linux beginner, not the creation of users, not by the editor will not like the installation package, please refer to: "a step in learning Linux and Windows to share files Samba". In this there is the collection and presentation, thank you ~


2, Samba file server for that;


Samba file server is Windows file sharing server, Network Places that thing is, this is the CIFS file system;


3, the complexity of the user permissions to build models and examples of file system;

For example, I would like to build a model of the following permissions:


3.1 file system structure planning;


In this file system, we have to allow all users have a unified path to the entrance; in the Windows file browser, we should \ \ IP or domain name \ shared directory name to view, and in Linux's Gnome file browser view is the smb: / / domain name or ip address / share directory name. And we let all users through the only access to shared file system address.

/ linuxsir (Note: Samba shared file system directory name)
|
| ─ ─ ─ / Management (a member of the management of the Department's home directory)
| |_______/ Sirmas01 (Note: The management of the home directory sirmas01 members sirmas01)
| |_______/ Sirmas02 (Note: The management of the home directory sirmas0202 members sirmas02)
|
| ─ ─ ─ / software (Note: The software shared directory, only members of the management of the Department Manager or higher authority can manage)
|
| ─ ─ ─ / public documents (Note: all users can view the document, only the management of the Department of sirmas01 and sirmas02 users have write access for document management)
| ─ ─ ─ / share writable (Note: all users can write to a file in this directory, sir03 or sir04 Users can manage, or file server administrators to manage user permissions)

| ─ ─ ─ / members (Note: employees in the home directory storage, each member in this directory has its own home directory)
| ─ ─ ─ ─ |_______/ sir03 (Note: sir03 the user's home directory)
| ─ ─ ─ ─ |_______/ sir04 (Note: sir04 the user's home directory)
We look at a map to the Windows File System Manager can see the Samba file system as an example; directory according to the above planning, we can see is how it should be the directory structure;




3.2 Example description of a document;


3.1 In accordance with the rules of file system structure, we have to say something simple, the file system, what features to achieve;

1] a unified registry for all users are imported linuxsir directory;
2] Management Directory: Management sirmas01 and sirmas02 directory under the directory. Members of the management of the Department of sirmas01 and private sirmas02 directory settings in the management of the Department of sirmas01 directory and the directory sirmas02 and siradm01 and users of these two siradm02 directory is privately owned, that is to say siradm01 users can view but can not write all siradmin02 directory siradm02. Similarly the contrary; sirmas01 and members of the management of the Department of sirmas02 users to manage / software, / public documents / share writable, / members of the directory;
3] software directory: This directory is stored in the storage software, sirmas01 users and sirmas02 users have the right to manage, to any user (including anonymous users) have read permission;
4] public document directory: This directory is a document storage company public places, such as the various systems and such document template. sirmas01 users and sirmas02 users have the right to manage, to any user (including anonymous users) have read permission;
5] The members of the directory: directory of members and sir03 under sir04 directory, sir03 and sir04 directory sir03 attributable to employees and all sir04 and can write. sir04 the sir03 user is entitled to see or write to each other's directory;
6] shared directory writable: writable shared directory is to enable all members can write, but the management of members in the management of the hands of the Department;

It would appear that a relatively complex model of the competence to build up on. Relatively clear and well-organized. Users also established a unified entrance. Samba configuration files in this relatively simple;


4, users and authority;


total siradm administrator, Samba file system can have a shared directory linuxsir all the permissions, including the deletion, write and other operations ... ...
sirmas01 administrator privileges, you can not operate in addition to the private directory sir02, other can be operated, including the deletion of, write, read ... ...
sirmas02 administrator privileges, you can not operate in addition to the private directory sir01, other can be operated, including the deletion of, write, read ... ...
sir03 ordinary users: In addition to operating their own private directory [sir03] directory other than, in the [share writable] directory have the right to write in the [software], [public document] only under the right view. Of [Management] directory and not the right to view and write;
sir04 ordinary user: and a similar sir03 users;


5, create a directory, users, user groups and set permissions;



5.1 Create directory



root @ beinanIBM: / home # mkdir-p / home / samba / Management / sirmas01
root @ beinanIBM: / home # mkdir-p / home / samba / Management / sirmas02
root @ beinanIBM: / home # mkdir / home / samba / software
root @ beinanIBM: / home # mkdir / home / samba / shared writable
root @ beinanIBM: / home # mkdir / home / samba / public documents

root @ beinanIBM: / home # mkdir-p / home / samba / members / sir03
root @ beinanIBM: / home # mkdir / home / samba / members / sir04


5.2 Create users and user groups;



root @ beinanIBM: / home # groupadd siradm
root @ beinanIBM: / home # groupadd sirmas
root @ beinanIBM: / home # groupadd siruser

root @ beinanIBM: / home # useradd-g siradm-G sirmas, siruser-d / home / samba-s / bin / false siradm
root @ beinanIBM: / home # useradd-g sirmas-G sirmas, siruser-d / home / samba-s / bin / false sirmas01
root @ beinanIBM: / home # useradd-g sirmas-G sirmas, siruser-d / home / samba-s / bin / false sirmas02
root @ beinanIBM: / home # useradd-g siruser-d / home / samba-s / bin / false sir03
root @ beinanIBM: / home # useradd-g siruser-d / home / samba-s / bin / false sir04


5.3 pairs of related and authority vested in the directory;



root @ beinanIBM: / home # ls-l | grep samba
drwxr-xr-x 5 root root 128 2007-07-13 14:54 samba

root @ beinanIBM: / home # ls-l | grep samba
drwxr-xr-x 5 siradm siradm 128 2007-07-13 14:54 samba

root @ beinanIBM: / home # cd / home / samba /


root @ beinanIBM: / home / samba # ls-lh
Total 0
drwxr-xr-x 2 root root 48 2007-07-13 14:53 software
drwxr-xr-x 2 root root 48 2007-07-13 15:35 public document
drwxr-xr-x 2 root root 48 2007-07-13 15:36 shared writable
drwxr-xr-x 4 root root 96 2007-07-13 15:37 a member of
drwxr-xr-x 4 root root 96 2007-07-13 15:36 Management

root @ beinanIBM: / home / samba # chown-R siradm: sirmas software can be written public document sharing management
root @ beinanIBM: / home / samba # chown-R siradm: siruser members

root @ beinanIBM: / home / samba # chmod 1777 share writable
root @ beinanIBM: / home / samba # chmod 775 software public document
root @ beinanIBM: / home / samba # chmod 770 members of the management of the Department of


root @ beinanIBM: / home / samba # ls-lh
Total 0
drwxrwxr-x 2 siradm sirmas 48 2007-07-13 14:53 software
drwxrwxr-x 2 siradm sirmas 48 2007-07-13 15:35 public document
drwxrwxrwt 2 siradm sirmas 48 2007-07-13 15:36 shared writable
drwxrwx --- 4 siradm siruser 96 2007-07-13 15:37 a member of
drwxrwx --- 4 siradm sirmas 96 2007-07-13 15:36 Management



root @ beinanIBM: / home / samba # cd members

root @ beinanIBM: / home / samba / members # chown sir03: sirmas sir03
root @ beinanIBM: / home / samba / members # chown sir03: sirmas sir04
root @ beinanIBM: / home / samba / members # chmod 770 sir03 sir04

root @ beinanIBM: / home / samba / members # ls-lh
Total 0

drwxrwx --- 2 sir03 sirmas 48 2007-07-13 14:53 sir03
drwxrwx --- 2 sir04 sirmas 48 2007-07-13 14:53 sir04

root @ beinanIBM: / home / samba / members # cd .. / Management /

root @ beinanIBM: / home / samba / Management # ls
sirmas01 sirmas02

root @ beinanIBM: / home / samba / Management # ls-lh
Total 0
drwxr-xr-x 2 root root 48 2007-07-13 14:54 sirmas01
drwxr-xr-x 2 root root 48 2007-07-13 14:54 sirmas02

root @ beinanIBM: / home / samba / Management # chown sirmas01: sirmas sirmas01
root @ beinanIBM: / home / samba / Management # chown sirmas02: sirmas sirmas02

root @ beinanIBM: / home / samba / Management # ls-lh
Total 0
drwxr-xr-x 2 sirmas01 sirmas 48 2007-07-13 14:54 sirmas01
drwxr-xr-x 2 sirmas02 sirmas 48 2007-07-13 14:54 sirmas02


6, modify the Samba configuration file;



[global]
workgroup = sirgrp
netbios name = sirserver
server string = linuxsir File Server
hosts allow = 192.168.1. 192.168.2. 127. # Note: to allow 192.168.1.2 and 192.168.1 and Section 127 network users can access; can change their own IP network segment,
security = share
printcap name = cups
printcap name = cups
guest account = nobody
guest ok = yes

[linuxsir] # Note: share of
comment = linuxsir samba server
path = / home / samba # in the Linux system, the location of the shared folder;
create mask = 0664 # Note: When users create a file to the limit;
directory mask = 0775 # Note: create a directory of rights;
writeable = yes # Note: can be written;
valid users = @ siradm, @ sirmas, @ siruser, nobody # Note: The effect of users and user groups, users and between user groups, separated from its user group to add @ symbol in front, nobody is anonymous users;
browseable = yes # Note: whether or not to browse it is;
guest ok = yes # Note: Anonymous users can visit;

Description: # Note that the content of descriptive, the use of this configuration file, please delete;


7, add Samba users;



root @ beinanIBM: / home / samba # smbpasswd-a siradm
New SMB password: 000000 Note: Enter 000000 as a password;
Retype new SMB password: 000000 Note: Confirm password;
Added user siradm

With the same approach to add sirmas01, sirmas02, sir03, sir04 users; modify Samba user's password using the following method:


smbpasswd username

Note: smbpasswd is used to set up Samba user's password is not set up the system user's password. Sambapasswd first principle is to read / etc / passwd on the user, then the user is added to the Samba user profile, in Slackware, it is wrote / etc / samba / private / smbpasswd, Samba user's password is written on the / etc / samba / private / smbpasswd and encryption to / etc / samba / private / secrets.tdb. The user's password system is the existence of / etc / shadow file. This seems a bit dizzy, is it? Users created in this way, using a system account, Samba users are also users of the system, but is separate from the password.

Simply put, we want to set the Samba password, we must first add the System account, and then use smbpasswd to add and create a password. When we wish to change the Samba password, but also through the smbpasswd.

If we want to change the password for this user? Use passwd tool;


8, start Samba file server;


Each release has a way to start the Samba server, if you are a novice, you can use the following methods to try; please refer to: "a step in learning Linux and Windows to share files Samba"


root @ beinanIBM: / home / samba # pkill smbd
root @ beinanIBM: / home / samba # pkill nmbd
root @ beinanIBM: / home / samba # / usr / sbin / smbd
root @ beinanIBM: / home / samba # / usr / sbin / nmbd


9, mounted Samba file system, and test the reliability of the file system;



Samba File System 9.1 visits;


If anonymous access, do not like login name, but also to the shared directory can be written into the document; under the anonymous access in the Windows file system is:


\ \ ip or domain name \ share name

Because we are here to share settings are linuxsir, and I wrote this article used the machine IP address is 192.168.1.19, then in the anonymous access in Windows, it should be IE address bar of your browser enter


\ \ 192.168.1.19 \ linuxsir

Note: In the Linux system, if you use the GNOME desktop environment, should be nautilus-connect-server, the terminal can be transferred under the order to fight the "server", server type choose Windows shared folders enter linuxsir, user name Department to enter a user name, regardless of what kind of user input, the password will not be prompted to verify that this is GNOME file manager, a BUG. To solve this problem, have to screen out anonymous user access, create a public account, such as sirall user, password is sirall. Of course, whether this is under Windows or Linux, you can not visit anonymous. If there is no account be allocated to a member of a company, can only be used to access sirall users. KDE may be in such a problem does not exist, try again, I do not have KDE, do not say this.

The prohibition of anonymous users to access, it is necessary to amend the smb.conf, generally located in / etc / samba / smb.conf; in front of the configuration file, there are the following line;


valid users = @ siradm, @ sirmas, @ siruser, nobody
Changed
valid users = @ siradm, @ sirmas, @ siruser

This put an anonymous user access the cut-off; If you only for Windows users with the network file server, or you are not using GNOME desktop, no need to ban anonymous users. GNOME desktop environment is mainly in the nautilus-connect-server process BUG. I also feel depressed ... ...


Samba mounted file system 9.2 to the local use;


In Windows,

Promised by mapping a network drive approach, please refer to "a step in learning Linux and Windows to share files Samba". If there can not mount Win2000, you have to build a Samba server the corresponding user name do. For example, sirmas01, and the users log on Win2000 systems, will be able to mount such a use.

But there are also a problem, when we started when an anonymous user access, and then a user name and password in order to mount a network drive before, it is necessary to disconnect an anonymous mount the network drive, in the right-click My Network Places. Disconnect mount before the network drive;

In the Linux System

If you use GNOME desktop environment, please refer to the previous mentioned;

You can also mount in order to implement;


root @ beinanIBM: / home / xbeinan # mkdir / mnt / linuxsir
root @ beinanIBM: / home / xbeinan # / sbin / mount.cifs / / 192.168.1.19/linuxsir / mnt / linuxsir-o user = sirmas01, pass = 111111
Or

root @ beinanIBM: / home / xbeinan # / sbin / mount-t cifs / / 192.168.1.19/linuxsir / mnt / linuxsir-o user = sirmas01, pass = 111111