AdminSysGNULinux

Voir aussi

• Samba-client SMB CIFS
• https://github.com/cisagov/samba-packer
• ksmbd: un nouveau serveur SMB intégré au noyau (mais problématique de sécurité)

RHEL6 ne supporte pas le protocole SMB2 et +

rlimit_max (1024) below minimum Windows limit (16384)

/etc/security/limits.d/30-samba.conf

root               -       nofile          16385

Défaut est max open files = 16385

Voir https://www.tecmint.com/install-samba-on-rhel-8-for-file-sharing-on-windows/

/etc/samba/smb.conf

[global]
        workgroup = WORKGROUP
        server string = Samba
        netbios name = SAMBA
        client ipc min protocol = SMB3
        client min protocol = SMB3
        server min protocol = SMB2
        disable netbios = Yes
        disable spoolss = Yes
        domain master = No      
        load printers = No
        local master = No
        log file = /var/log/samba/log.%m
 
        # Size in KB
        max log size = 200000
 
        name resolve order = host
        printcap name = /dev/null
        security = USER
        smb ports = 445
        idmap config * : backend = tdb
        passdb backend = tdbsam
        cups options = raw
        printing = bsd
        #log level = 3
        #restrict anonymous = 2
        #nt pipe support = no
        #interfaces = eth* lo
        #bind interfaces only = yes
        #fstype = Samba
        host msdfs = no
        server services = -s3fs, -rpc, -nbt, -wrepl, -ldap, -cldap, -kdc, -drepl, -winbindd, -ntp_signd, -kcc, -dnsupdate, -dns
 
[public]
        comment = Public
        read only = Yes
        path = /data/shared/public
 
[shared]
        #guest ok = Yes
        #browseable = No
        comment = Shared
        path = /mnt/shared
        read only = No
        #force user = jean
        valid users = jean
        write list = jean
 
#[IPC$]
#        hosts allow = 192.168.115.0/24 127.0.0.1
#        hosts deny = 0.0.0.0/0

Nul besoin de redémarrer le service, les modifications sont automatiquement prises en compte. Pour vérifier

testparm

Pour tester la connexion

smbclient -N -L 127.0.0.1
smbclient -N //127.0.0.1/shared
smbclient -U user%password //127.0.0.1/shared

Si besion modifier /etc/sysconfig/iptables ou firewalld

#iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 139 -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 445 -j ACCEPT

Exemple :

/etc/samba/smb.conf

[partage]
   comment = Commentaires...
   path = /var/www
   force user = web
   #valid users = web
   browseable = yes
   writable = yes

Valider la configuration

testparm

Reload de la conf sans redémarrer

smbcontrol all reload-config

Redémarrer le service

systemctl restart smb

C'est une fausse bonne idée car pas de reload automatique

/etc/samba/smb.conf

[global]
        path = /dev/null
 
[includes]
        available = No
        include = /etc/samba/smb.d/shared.conf

/etc/samba/smb.d/shared.conf

[shared]
        comment = Shared
        path = /mnt/shared
        read only = No

Comment c'est configuré

testparm -sv /dev/null | grep auth
 
testparm -s '--parameter-name=server role'

Autoriser un utilisateur / définition du MDP

#pdbedit -a utilisateur
​smbpasswd -a utilisateur

Les utilisateurs à ajouter doivent exister au préalable dans /etc/passwd.

Cette option (et les suivantes) n'est disponible que lorsque smbpasswd est exécuté en tant que root

Supprimer un compte (retour arrière à précédent)

smbpasswd -x supervision

Désactiver un compte

smbpasswd -d supervision

Liste tous les comptes

pdbedit -L

Vérif l’existence de l'utilisateur pirate

pdbedit -u pirate

Dans un script shell

$ echo -n "P@ssw0rd" | base64
UEBzc3cwcmQ=

Duplication de l'entrée standard avec tee

# tee /dev/stdout
 
echo "UEBzc3cwcmQ=" | ( base64 -di ; echo )  | tee >(echo "$(</dev/stdin)") | smbpasswd -as user_samba

/etc/samba/smb.conf

[global]
load printers = no
printing = bsd
printcap name = /dev/null
disable spoolss = yes

Source : http://mugurel.sumanariu.ro/linux/linux-how-to-disable-printing-in-samba/

/etc/samba/smb.conf

[global]
   log level = 3

Pas besoin de redémarrer le service, le reload est auto

smbstatus

smb: \> get plop
Receiving SMB: Server stopped responding
Call returned zero bytes (EOF) opening remote file \plop

Le pb venait du fait que la partition /var était pleine.

Voir https://bgstack15.wordpress.com/2017/10/01/samba-and-ntlm-for-windows-clients/

/etc/samba/smb.conf

[global]
ntlm auth = yes
#client ntlmv2 auth = yes

Exemple de conf

Install sous RedHat / CentOS

cp -p /etc/samba/smb.conf /etc/samba/smb.conf.bak
egrep -v '^$|^#|^;' /etc/samba/smb.conf.bak > /etc/samba/smb.conf

/etc/samba/smb.conf

[global]
   workgroup = WORKGROUP
   dns proxy = no
   log file = /var/log/samba/log.%m
   max log size = 1000
   syslog = 0
   panic action = /usr/share/samba/panic-action %d
   server role = standalone server
   passdb backend = tdbsam
   obey pam restrictions = yes
   unix password sync = yes
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
   pam password change = yes
   map to guest = bad user
   usershare allow guests = yes
 
[tmp]
   path = /tmp
   comment = TEMP
   browseable = yes
   read only = no
   create mask = 0660
   directory mask = 0770
   guest ok = yes
 
[partage]
   comment = Partage
   path = /data/
   force user = utilisateur1
   #public = yes
   valid users = @groupe1, jean
   write list = @groupe1, jean
   browseable = yes
   writable = yes
   read only = no

Pour conteneurs

/usr/sbin/smbd -F -S