我的 smb.conf 很簡單，注意VFS 的設定。
[AAcompany]
path = /DATA/AAcompany
writeable = yes
create mode = 770
directory mode = 770
vfs objects = recycle
recycle: keeptree = yes
;vfs object = /usr/lib/Samba/vsf/recycle.so
;vfs options = /etc/Samba/recycle.conf
;recycle: repository = recycle
;recycle: repository = ../../AAcompany_recycle/%u
recycle: repository = Recycle/%U
recycle: exclude = .tmp|.temp|.o|.obj
recycle: versions = yes
recycle:touch = Yes
2009年7月22日 星期三
建立 SAMBA 的多用戶組
1- 分 7 個用戶組，在一個「main folder」下再有 7 個 sub folder ，對號入座，互不相屬。
2- 作為內部交換，設一個 exchange，再設一個公開區為 public。
3- 應用 3.x 的 vfs 功能，設立「資源回收桶」Recycle。全數共 9 個，結構如下表。
/DATA/----- manager
boss
supervisor
secretary
clerk
oa
pit_station
exchange
public
Recycle
4- 「權限」區分：有兩個方法，一是在「Linux ACL」做分組授權，另一方法在 smb.conf 設。試了很久，決定用前者，即 Linux ACL 做工夫。
5- 為使特定的各組能進入 /DATA 內，先設一群組 main_AAcompany ，其下的 exchange、public 及 Recycle 均以它為群組。
例： chown root:main_AAcompany Recycle
6- 以手動或利用 webmin 將不同群組撥入，如 AAcompany_manager 群組亦包括其它群組，方便 AAcompany_manager 群組的人進入所有 foledr 區。
例： create,AAcompany_manager,,600,"AAcompany_pit_station,AAcompany_oa,AAcompany_supervisor,AAcompany_clerk,AAcompany_secretary,AAcompany_boss,main_AAcompany,"
7- 不管是 main folder 或專屬 sub folder 均改為 0770 ，作為權限的區分。情況如下表。
[root@SMB75 AAcompany]# chown root:main_AAcompany Recycle
[root@SMB75 AAcompany]# ll
total 40
drwxrwx--- 2 root AAcompany_manager 4096 Jul 18 08:16 manager
drwxrwx--- 2 root AAcompany_boss 4096 Jul 18 08:17 boss
drwxrwx--- 2 root AAcompany_supervisor 4096 Jul 18 08:17 supervisor
drwxrwx--- 2 root AAcompany_secretary 4096 Jul 21 08:12 secretary
drwxrwx--- 2 root AAcompany_clerk 4096 Jul 20 12:16 clerk
drwxrwx--- 2 root AAcompany_oa 4096 Jul 21 08:05 oa
drwxrwx--- 2 root AAcompany_pit_station 4096 Jul 18 08:17 pit_station
drwxrwx--- 3 root main_AAcompany 4096 Jul 20 12:13 exchange
drwxrwx--- 3 root main_AAcompany 4096 Jul 20 13:46 public
drwx------ 3 root main_AAcompany 4096 Jul 21 08:03 Recycle
8- 較特別的一點是 recycle ，目前只做到所有 del 文件放入 /DATA/Recycle 內，保安有漏洞。
因此亦利用 ACL 特別設定，如下列：
[root@SMB75 AAcompany]# chmod 1770 Recycle/
7- 完成。跟著是將 user 加入到相關的 group 中。
2- 作為內部交換，設一個 exchange，再設一個公開區為 public。
3- 應用 3.x 的 vfs 功能，設立「資源回收桶」Recycle。全數共 9 個，結構如下表。
/DATA/----- manager
boss
supervisor
secretary
clerk
oa
pit_station
exchange
public
Recycle
4- 「權限」區分：有兩個方法，一是在「Linux ACL」做分組授權，另一方法在 smb.conf 設。試了很久，決定用前者，即 Linux ACL 做工夫。
5- 為使特定的各組能進入 /DATA 內，先設一群組 main_AAcompany ，其下的 exchange、public 及 Recycle 均以它為群組。
例： chown root:main_AAcompany Recycle
6- 以手動或利用 webmin 將不同群組撥入，如 AAcompany_manager 群組亦包括其它群組，方便 AAcompany_manager 群組的人進入所有 foledr 區。
例： create,AAcompany_manager,,600,"AAcompany_pit_station,AAcompany_oa,AAcompany_supervisor,AAcompany_clerk,AAcompany_secretary,AAcompany_boss,main_AAcompany,"
7- 不管是 main folder 或專屬 sub folder 均改為 0770 ，作為權限的區分。情況如下表。
[root@SMB75 AAcompany]# chown root:main_AAcompany Recycle
[root@SMB75 AAcompany]# ll
total 40
drwxrwx--- 2 root AAcompany_manager 4096 Jul 18 08:16 manager
drwxrwx--- 2 root AAcompany_boss 4096 Jul 18 08:17 boss
drwxrwx--- 2 root AAcompany_supervisor 4096 Jul 18 08:17 supervisor
drwxrwx--- 2 root AAcompany_secretary 4096 Jul 21 08:12 secretary
drwxrwx--- 2 root AAcompany_clerk 4096 Jul 20 12:16 clerk
drwxrwx--- 2 root AAcompany_oa 4096 Jul 21 08:05 oa
drwxrwx--- 2 root AAcompany_pit_station 4096 Jul 18 08:17 pit_station
drwxrwx--- 3 root main_AAcompany 4096 Jul 20 12:13 exchange
drwxrwx--- 3 root main_AAcompany 4096 Jul 20 13:46 public
drwx------ 3 root main_AAcompany 4096 Jul 21 08:03 Recycle
8- 較特別的一點是 recycle ，目前只做到所有 del 文件放入 /DATA/Recycle 內，保安有漏洞。
因此亦利用 ACL 特別設定，如下列：
[root@SMB75 AAcompany]# chmod 1770 Recycle/
7- 完成。跟著是將 user 加入到相關的 group 中。
2009年7月4日 星期六
讓用戶可以改 login samba 的密碼
核心問題就如標題。
最近要架一個有近 250 人賬戶的 samba server，
當中同時會使用的人不超過 30 人。
決定用 centos 5.3 做測試，並由我建賬號第一次登入密碼，用戶則以 changepassword 來更改密碼。
以前也試用這個方法，沒問題的。但這次不成功，用戶改密碼後一直無法進入 samba，
查了很久，知道是 tdbsam 問題，再用 webmin 1.48 做同步，亦不成功。
想了很久，還是先讓 samba 3.033 用回舊版的 smbpasswd 吧。
方法很簡單：
1- ssh 入系統，su 為 root 。
2- 打入 vi /etc/samba/smb.conf。
3- 在 [global] 中，註解 passdb backend = tdbsam 。
4- 加入 smb passwd file=/etc/samba/smbpasswd，如下例。
# passdb backend = tdbsam
smb passwd file=/etc/samba/smbpasswd
最後，還是那個老問題，該學好 python ，不要再浪費氣力繞大圈了。
最近要架一個有近 250 人賬戶的 samba server，
當中同時會使用的人不超過 30 人。
決定用 centos 5.3 做測試，並由我建賬號第一次登入密碼，用戶則以 changepassword 來更改密碼。
以前也試用這個方法，沒問題的。但這次不成功，用戶改密碼後一直無法進入 samba，
查了很久，知道是 tdbsam 問題，再用 webmin 1.48 做同步，亦不成功。
想了很久，還是先讓 samba 3.033 用回舊版的 smbpasswd 吧。
方法很簡單：
1- ssh 入系統，su 為 root 。
2- 打入 vi /etc/samba/smb.conf。
3- 在 [global] 中，註解 passdb backend = tdbsam 。
4- 加入 smb passwd file=/etc/samba/smbpasswd，如下例。
# passdb backend = tdbsam
smb passwd file=/etc/samba/smbpasswd
最後，還是那個老問題，該學好 python ，不要再浪費氣力繞大圈了。
2009年7月2日 星期四
筆記：smbpasswd 與 pdbedit
http://us1.samba.org/samba/docs/man/Samba-HOWTO-Collection/passdb.html
Account Management Tools
Samba provides two tools for management of user and machine accounts: smbpasswd and pdbedit.
The pdbedit can be used to manage account policies in addition to Samba user account information. The policy management capability is used to administer domain default settings for password aging and management controls to handle failed login attempts.
Some people are confused when reference is made to smbpasswd because the name refers to a storage mechanism for SambaSAMAccount information, but it is also the name of a utility tool. That tool is destined to eventually be replaced by new functionality that is being added to the net toolset.
The smbpasswd Tool
The smbpasswd utility is similar to the passwd and yppasswd programs. It maintains the two 32 byte password fields in the passdb backend. This utility operates independently of the actual account and password storage methods used (as specified by the passdb backend in the smb.conf file).
smbpasswd works in a client-server mode where it contacts the local smbd to change the user's password on its behalf. This has enormous benefits.
smbpasswd has the capability to change passwords on Windows NT servers (this only works when the request is sent to the NT PDC if changing an NT domain user's password).
smbpasswd can be used to:
* add user or machine accounts.
* delete user or machine accounts.
* enable user or machine accounts.
* disable user or machine accounts.
* set to NULL user passwords.
* manage interdomain trust accounts.
To run smbpasswd as a normal user, just type:
$ smbpasswd
Old SMB password: secret
For secret, type the old value here or press return if there is no old password.
New SMB Password: new secret
Repeat New SMB Password: new secret
If the old value does not match the current value stored for that user, or the two new values do not match each other, then the password will not be changed.
When invoked by an ordinary user, the command will allow only the user to change his or her own SMB password.
When run by root, smbpasswd may take an optional argument specifying the username whose SMB password you wish to change. When run as root, smbpasswd does not prompt for or check the old password value, thus allowing root to set passwords for users who have forgotten their passwords.
smbpasswd is designed to work in the way familiar to UNIX users who use the passwd or yppasswd commands. While designed for administrative use, this tool provides essential user-level password change capabilities.
For more details on using smbpasswd, refer to the man page (the definitive reference).
The pdbedit Tool
pdbedit is a tool that can be used only by root. It is used to manage the passdb backend, as well as domain-wide account policy settings. pdbedit can be used to:
* add, remove, or modify user accounts.
* list user accounts.
* migrate user accounts.
* migrate group accounts.
* manage account policies.
* manage domain access policy settings.
Under the terms of the Sarbanes-Oxley Act of 2002, American businesses and organizations are mandated to implement a series of internal controls and procedures to communicate, store, and protect financial data. The Sarbanes-Oxley Act has far reaching implications in respect of:
1. Who has access to information systems that store financial data.
2. How personal and financial information is treated among employees and business partners.
3. How security vulnerabilities are managed.
4. Security and patch level maintenance for all information systems.
5. How information systems changes are documented and tracked.
6. How information access controls are implemented and managed.
7. Auditability of all information systems in respect of change and security.
8. Disciplinary procedures and controls to ensure privacy.
In short, the Sarbanes-Oxley Act of 2002 is an instrument that enforces accountability in respect of business related information systems so as to ensure the compliance of all information systems that are used to store personal information and particularly for financial records processing. Similar accountabilities are being demanded around the world.
The need to be familiar with the Samba tools and facilities that permit information systems operation in compliance with government laws and regulations is clear to all. The pdbedit is currently the only Samba tool that provides the capacity to manage account and systems access controls and policies. During the remaining life-cycle of the Samba-3 series it is possible the new tools may be implemented to aid in this important area.
Account Management Tools
Samba provides two tools for management of user and machine accounts: smbpasswd and pdbedit.
The pdbedit can be used to manage account policies in addition to Samba user account information. The policy management capability is used to administer domain default settings for password aging and management controls to handle failed login attempts.
Some people are confused when reference is made to smbpasswd because the name refers to a storage mechanism for SambaSAMAccount information, but it is also the name of a utility tool. That tool is destined to eventually be replaced by new functionality that is being added to the net toolset.
The smbpasswd Tool
The smbpasswd utility is similar to the passwd and yppasswd programs. It maintains the two 32 byte password fields in the passdb backend. This utility operates independently of the actual account and password storage methods used (as specified by the passdb backend in the smb.conf file).
smbpasswd works in a client-server mode where it contacts the local smbd to change the user's password on its behalf. This has enormous benefits.
smbpasswd has the capability to change passwords on Windows NT servers (this only works when the request is sent to the NT PDC if changing an NT domain user's password).
smbpasswd can be used to:
* add user or machine accounts.
* delete user or machine accounts.
* enable user or machine accounts.
* disable user or machine accounts.
* set to NULL user passwords.
* manage interdomain trust accounts.
To run smbpasswd as a normal user, just type:
$ smbpasswd
Old SMB password: secret
For secret, type the old value here or press return if there is no old password.
New SMB Password: new secret
Repeat New SMB Password: new secret
If the old value does not match the current value stored for that user, or the two new values do not match each other, then the password will not be changed.
When invoked by an ordinary user, the command will allow only the user to change his or her own SMB password.
When run by root, smbpasswd may take an optional argument specifying the username whose SMB password you wish to change. When run as root, smbpasswd does not prompt for or check the old password value, thus allowing root to set passwords for users who have forgotten their passwords.
smbpasswd is designed to work in the way familiar to UNIX users who use the passwd or yppasswd commands. While designed for administrative use, this tool provides essential user-level password change capabilities.
For more details on using smbpasswd, refer to the man page (the definitive reference).
The pdbedit Tool
pdbedit is a tool that can be used only by root. It is used to manage the passdb backend, as well as domain-wide account policy settings. pdbedit can be used to:
* add, remove, or modify user accounts.
* list user accounts.
* migrate user accounts.
* migrate group accounts.
* manage account policies.
* manage domain access policy settings.
Under the terms of the Sarbanes-Oxley Act of 2002, American businesses and organizations are mandated to implement a series of internal controls and procedures to communicate, store, and protect financial data. The Sarbanes-Oxley Act has far reaching implications in respect of:
1. Who has access to information systems that store financial data.
2. How personal and financial information is treated among employees and business partners.
3. How security vulnerabilities are managed.
4. Security and patch level maintenance for all information systems.
5. How information systems changes are documented and tracked.
6. How information access controls are implemented and managed.
7. Auditability of all information systems in respect of change and security.
8. Disciplinary procedures and controls to ensure privacy.
In short, the Sarbanes-Oxley Act of 2002 is an instrument that enforces accountability in respect of business related information systems so as to ensure the compliance of all information systems that are used to store personal information and particularly for financial records processing. Similar accountabilities are being demanded around the world.
The need to be familiar with the Samba tools and facilities that permit information systems operation in compliance with government laws and regulations is clear to all. The pdbedit is currently the only Samba tool that provides the capacity to manage account and systems access controls and policies. During the remaining life-cycle of the Samba-3 series it is possible the new tools may be implemented to aid in this important area.
2009年6月18日 星期四
2009年6月3日 星期三
Samba 拒絕存取
以 xp 連入 b2d 的 samba 後，
無法寫入檔案，回應是「拒絕存取」。
搞了半天，還是權限問題：
原來是： drwxr-xr-x 2 root o_office 4096 2009-06-03 11:30 O-office
打指令 chmod 775 O-office
更改為： drwxrwxr-x 25 root o_office 4096 2009-06-03 12:14 O-office
問題解決了，記下來：
使用 Samba 時，除 Samba 外，Linux 權限亦必須一併考慮好設定好！
無法寫入檔案，回應是「拒絕存取」。
搞了半天，還是權限問題：
原來是： drwxr-xr-x 2 root o_office 4096 2009-06-03 11:30 O-office
打指令 chmod 775 O-office
更改為： drwxrwxr-x 25 root o_office 4096 2009-06-03 12:14 O-office
問題解決了，記下來：
使用 Samba 時，除 Samba 外，Linux 權限亦必須一併考慮好設定好！
訂閱：
文章 (Atom)