Опубликован: 06.08.2012 | Доступ: свободный | Студентов: 1189 / 25 | Оценка: 5.00 / 5.00 | Длительность: 53:41:00
Лекция 25:

Basic network access: servers

The [global] section

As the name suggests, the [global] section defines parameters that either apply to the server as a whole, or that are defaults for the other services. The interesting ones for us are:

  • The workgroup parameter defines the Microsoft workgroup to which this server belongs. Set it to match the Microsoft environment. In these examples, we'll assume:
    workgroup = EXAMPLE
  • The printing entry specifies what kind of printer support Samba provides. Current versions of Samba support CUPS. If you are using CUPS (not described in this book), you don't need to do anything. Otherwise set:
    printcap name = /etc/printcap
    printing = bsd
  • guest account is the account (in UNIX terms: user ID) to use if no password is supplied. You probably want to define a guest account, since many Microsoft clients don't use user IDs. Ensure that the privileges are set appropriately. Alternatively, alter the parameter to point to an existing user.
  • Modern versions of Microsoft use a simple form of password encryption; older versions used none. Currently, Samba defaults to no encryption. Set encrypt passwords to yes.
  • Microsoft uses its own version of host name resolution, which doesn't involve DNS. Optionally, Samba will map Microsoft names to DNS. To enable this option, set dns proxy to yes.
  • By default, the log file is specified as /var/log/log. The text replaced by the name of the remote machine, so you get one log file per machine. Unfortunately, the name doesn't make it clear that this is a Samba log file. It's better to change this entry to:
    log file = /var/log/samba.log.%m
  • socket options is hardly mentioned in the documentation, but it's very important: many Microsoft implementations of TCP/IP are inefficient and establish a new TCP connection more often than necessary. Select the socket options TCP_NODELAY and IPTOS_LOWDELAY, which can speed up the response time of such applications by over 95%.
The [homes] section

The [homes] section allows clients to connect to their home directories without needing an entry in the configuration file. If this section is present, and an incoming request specifies a service that is not defined in the configuration file, Samba checks if it matches a user ID. If it does, and if the specified password is correct, Samba creates a service that supplies the user's home directory.

The following options are of interest in the [homes] section:

  • writeable can be yes or no, and specifies whether the user is allowed to write to the directory.
  • create mode specifies the permission bits (in octal) to set for files that are created.
  • public specifies whether other users are allowed access to this directory. In combination with a guest user, this can be a serious security liability.
The [printers] section

The [printers] section describes printing services. It doesn't need the names of the printers: if it doesn't find the specified service, either in the configuration file or in the [homes] section, if it exists, it looks for them in the /etc/printcap file.

The Samba documentation claims that Samba can recognize BSD printing system automatically, but this is not always correct. Ensure that you have the following entries:

printing = bsd                      in the [global] sectionW
print command = lpr -r -P'%p' '%s'  in the [printers] sectionW

Note the printable option in the [printers] section: this is the option that distinguishes between printers ("yes")and file shares ("no").

Other sections: service descriptions

Samba takes any section name except for [global], [homes] or [printers] as the definition of a service. A typical example might be:

  comment = ftp server file area
  path = /var/spool/ftp/pub
  read only = yes
  public = yes
  write list = grog

This entry defines access to the anonymous ftp section. Anybody can read it, but only user grog can write to it.

Setting passwords

Samba uses a separate password file, /usr/local/private/secrets.tdb. To set up users, use the smbpasswd command, which copies the information from the system password file:

# smbpasswd -a grog
New SMB password:
Retype new SMB password:         as usual, no echo
Password changed for user grog.

Testing the installation

Once you have performed the steps described above, you can proceed to test the installation. First, run testparm to check the correctness of the configuration file:

$ testparm
Load smb config files from /usr/local/etc/smb.conf
Processing section "[homes]"
Processing section "[printers]"
Processing section "[ftp]"
Processing section "[src]"
Processing section "[grog]"
Loaded services file OK.
Press enter to see a dump of your service definitions    Press Enter

Global parameters:
lots of information which could be of use in debugging

  comment = Home Directories
  read only = No

  comment = All Printers
  path = /var/spool/samba
  guest ok = Yes
  printable = Yes
  browseable = No

  comment = ftp server file area
  path = /var/spool/ftp/pub
  write list = grog
  guest ok = Yes

  path = /home/grog
  valid users = grog
  read only = No

As you see, testparm spells out all the parameters that have been created, whether explicitly or by default. If you run into problems, this is the first place to which to return.

Next, check that you can log in with smbclient. If you're running the servers as daemons, start them now. If you're starting them from inetd, you don't need to do anything.

$ smbclient -L freebie -U grog
added interface ip= bcast= nmask=
Password:               as usual, no echo
Domain=[EXAMPLE]  OS=[Unix]  Server=[Samba 2.2.7a]

Sharename  Type  Comment
---------  ----  -------
homes      Disk  Home Directories
ftp        Disk  ftp server file area
grog       Disk
IPC$       IPC   IPC Service (Samba Server)
ADMIN$     Disk  IPC Service (Samba Server)

Server   Comment
------   -------
FREEBIE  Samba Server
PRESTO   Samba Server

Workgroup  Master
---------  ------

If you get this far, your password authentication is working. Finally, try to access the shares. Samba services are specified in Microsoft format: \\system\service. To make this worse, UNIX interprets the \ character specially, so you would need to repeat the character. For example, to access the ftp service on freebie, you would have to enter \\\\freebie\\ftp. Fortunately, smbclient understands UNIX-like names, so you can write //freebie/ftp instead.

To test, start smbclient from another system:

$ smbclient //freebie/ftp -U grog
added interface ip= bcast= nmask=
Password:           as usual, no echo
Domain=[EXAMPLE] OS=[Unix] Server=[Samba 2.2.7a]
smb: \> ls
  .                               DR      0  Wed Jan 29 12:06:29 2003
  ..                               D      0  Sat Oct 26 10:36:29 2002
  instant-workstation-1.0.tar.gz       9952  Mon Mar 19 11:49:01 2001
xtset-1.0.tar.gz                       4239  Mon Aug  5 16:44:14 2002
gpart-0.1h.tbz.tgz                    27112  Tue Aug 27 10:07:59 2002

If you get this far, Samba is working. The next step is to attach to the services from the Microsoft machines. That's not a topic for this book. Note, however, that Samba only works with TCP/IP transport, not with NetBEUI.

Displaying Samba status

You can display the status of Samba connections with smbstatus. For example,

$ smbstatus
Samba version 2.2.7a
Service  uid   gid      pid    machine
ftp      grog  example  37390  freebie  ( Mon Mar 31 13:48:13 2003

No locked files