1、建立samba共享，共享目錄為/data，要求：（描述完整的過程）
1)共享名為shared，工作組為magedu；
2)添加組develop，添加用戶gentoo,centos和ubuntu，其中gentoo和centos以develop為附加組，ubuntu不屬于develop組；密碼均為用戶名；
3)添加samba用戶gentoo,centos和ubuntu，密碼均為“mageedu”；
4)此samba共享shared僅允許develop組具有寫權限，其他用戶只能以只讀方式訪問；
5)此samba共享服務僅允許來自于172.16.0.0/16網絡的主機訪問；
系統： CentOS7.2
samba服務端：172.16.0.11
samba客戶端：172.16.0.13
一、服務端
（1） 安裝
[root@www ~]# yum -y install samba
[root@www ~]# systemctl start nmb.service
[root@www ~]# systemctl start smb.service
[root@www ~]# ss -tunlp | grep nmbd
udp UNCONN 0 0 172.16.255.255:137 *:* users:(("nmbd",pid=15220,fd=19))
udp UNCONN 0 0 172.16.0.11:137 *:* users:(("nmbd",pid=15220,fd=18))
udp UNCONN 0 0 *:137 *:* users:(("nmbd",pid=15220,fd=16))
udp UNCONN 0 0 172.16.255.255:138 *:* users:(("nmbd",pid=15220,fd=21))
udp UNCONN 0 0 172.16.0.11:138 *:* users:(("nmbd",pid=15220,fd=20))
udp UNCONN 0 0 *:138 *:* users:(("nmbd",pid=15220,fd=17))
[root@www ~]# ss -tulnp | egrep 'smbd|nmbd'
udp UNCONN 0 0 172.16.255.255:137 *:* users:(("nmbd",pid=15220,fd=19))
udp UNCONN 0 0 172.16.0.11:137 *:* users:(("nmbd",pid=15220,fd=18))
udp UNCONN 0 0 *:137 *:* users:(("nmbd",pid=15220,fd=16))
udp UNCONN 0 0 172.16.255.255:138 *:* users:(("nmbd",pid=15220,fd=21))
udp UNCONN 0 0 172.16.0.11:138 *:* users:(("nmbd",pid=15220,fd=20))
udp UNCONN 0 0 *:138 *:* users:(("nmbd",pid=15220,fd=17))
tcp LISTEN 0 50 *:139 *:* users:(("smbd",pid=15229,fd=38))
tcp LISTEN 0 50 *:445 *:* users:(("smbd",pid=15229,fd=37))
tcp LISTEN 0 50 :::139 :::* users:(("smbd",pid=15229,fd=36))
tcp LISTEN 0 50 :::445 :::* users:(("smbd",pid=15229,fd=35))
(2) 創建共享目錄
[root@www samba]# mkdir /data
(3) 創建系統組和系統用戶
[root@www samba]# groupadd develop [root@www samba]# useradd -G develop gentoo [root@www samba]# useradd -G develop centos [root@www samba]# useradd ubuntu [root@www samba]# echo "gentoo" | passwd --stdin gentoo [root@www samba]# echo "centos" | passwd --stdin centos [root@www samba]# echo "ubuntu" | passwd --stdin ubuntu
(4) 給共享目錄授權系統權限
[root@www samba]# ls -ld /data drwxr-xr-x 2 root root 6 Apr 17 22:52 /data [root@www samba]# chown .develop /data [root@www samba]# ls -ld /data drwxr-xr-x 2 root develop 6 Apr 17 22:52 /data [root@www samba]# chmod g+w /data [root@www samba]# ls -ld /data drwxrwxr-x 2 root develop 6 Apr 17 22:52 /data
(5) 添加samba用戶
[root@www samba]# smbpasswd -a gentoo [root@www samba]# smbpasswd -a centos [root@www samba]# smbpasswd -a ubuntu
(6) 修改samba配置文件
[root@www ~]# cd /etc/samba/
[root@www samba]# cp smb.conf{,.bak}
[root@www samba]# vim smb.conf
[global]
workgroup = magedu #samba主機所屬工作組
#自定義共享
[shared]
comment = shared
path = /data
#寫列表, 此處為系統組
write list = @develop
#訪問控制
hosts allow = 172.16.
(7) 語法檢查
[root@www samba]# testparm
二、客戶端
(1）安裝samba-client
[root@localhost ~]# yum -y install samba-client
(2) 安裝客戶端依賴包
yum install krb5-devel krb5-libs pam_krb5 krb5-workstation -y
如果不安裝，會報以下錯誤
[root@localhost ~]# smbclient -L 172.16.0.11 -U gentoo smbclient: relocation error: /lib64/libsamba-credentials.so.0: symbol GSS_KRB5_CRED_NO_CI_FLAGS_X, version gssapi_krb5_2_MIT not defined in file libgssapi_krb5.so.2 with link time reference
(3) 驗證
a)查看共享
[root@localhost ~]# smbclient -L 172.16.0.11 -U gentoo Enter gentoo's password:
Domain=[MAGEDU #SAMBA主機所屬工作組] OS=[Windows 6.1] Server=[Samba 4.4.4]
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
IPC$ IPC IPC Service (Samba 4.4.4)
shared Disk shared
gentoo Disk Home Directories
Domain=[MAGEDU #SAMBA主機所屬工作組] OS=[Windows 6.1] Server=[Samba 4.4.4]
Server Comment
--------- -------
Workgroup Master
--------- -------
b)用gentoo上傳文件
[root@localhost ~]# smbclient //172.16.0.11/shared -U gentoo
Enter gentoo's password:
Domain=[MAGEDU #SAMBA主機所屬工作組] OS=[Windows 6.1] Server=[Samba 4.4.4]
smb: \> ls
. D 0 Mon Apr 17 22:52:59 2017
.. DR 0 Mon Apr 17 22:52:59 2017
41922560 blocks of size 1024. 40704776 blocks available
smb: \> lcd /etc
smb: \> put fstab
putting file fstab as \fstab (25.2 kb/s) (average 25.2 kb/s)
smb: \> ls
. D 0 Mon Apr 17 23:35:43 2017
.. DR 0 Mon Apr 17 22:52:59 2017
fstab A 465 Mon Apr 17 23:35:43 2017
41922560 blocks of size 1024. 40704688 blocks available
smb: \> exit
服務端驗證:
[root@www samba]# ls /data/
fstab
c)用ubuntu上傳文件
[root@localhost ~]# smbclient //172.16.0.11/shared -U ubuntu
Enter ubuntu's password:
Domain=[MAGEDU #SAMBA主機所屬工作組] OS=[Windows 6.1] Server=[Samba 4.4.4]
smb: \> ls
. D 0 Mon Apr 17 23:35:43 2017
.. DR 0 Mon Apr 17 22:52:59 2017
fstab A 465 Mon Apr 17 23:35:43 2017
41922560 blocks of size 1024. 40704728 blocks available
smb: \> lcd /etc
smb: \> put hosts
NT_STATUS_ACCESS_DENIED opening remote file \hosts
提示沒有打開hosts文件的權限
d)驗證訪問控制
為了方便測試,修改服務端配置
hosts allow = 172.17.
客戶端驗證, 提示無訪問權限,證明配置正確
[root@localhost ~]# smbclient //172.16.0.11/shared -U gentoo Enter gentoo's password: Domain=[MAGEDU #SAMBA主機所屬工作組] OS=[Windows 6.1] Server=[Samba 4.4.4] tree connect failed: NT_STATUS_ACCESS_DENIED
修改為原來的配置
hosts allow = 172.16.
2、搭建一套文件vsftp文件共享服務，共享目錄為/ftproot,要求：（描述完整的過程）
1)基于虛擬用戶的訪問形式；
2)匿名用戶只允許下載，不允許上傳；
3)禁錮所有的用戶于其家目錄當中；
4)限制最大并發連接數為200:；
5)匿名用戶的最大傳輸速率512KB/s
6)虛擬用戶的賬號存儲在mysql數據庫當中。
7)數據庫通過NFS進行共享。
系統 ： CentOS7.2
服務器1： 172.16.0.11 vsftpd, mariadb
服務器2： 172.16.0.13 nfs(到處mariadb數據目錄)
一、NFS共享數據庫數據目錄
nfs server導出/mydata/data目錄, 客戶端以此目錄為其mariadb服務的數據目錄,要求mariadb要能啟動成功, 并能管理數據
注意:1. 兩邊mysql用戶id一致, 且在nfs端要有寫權限 2. 初始化是root進行的, 初始化時設置no_root_squash; 初始化完成后, 去掉no_squash
(1) nfs服務器(13)
a) 安裝
[root@localhost ~]# yum -y install nfs-utils 啟動: [root@localhost ~]# systemctl start nfs.service [root@localhost ~]# ss -tnlp | grep 2049 LISTEN 0 64 *:2049 *:* LISTEN 0 64 :::2049 :::*
b) 準備共享目錄并導出
[root@localhost ~]# mkdir -p /mydata/data [root@localhost ~]# vim /etc/exports.d/mydata.exports # 這時可讀寫, 不壓縮root權限(mariadb初始化時需要root權限) /mydata/data 172.16.0.0/16(rw,no_root_squash) 導出: [root@localhost ~]# exportfs -r 查看導出: [root@localhost ~]# showmount -e 172.16.0.13 Export list for 172.16.0.13: /mydata/data 172.16.0.0/16
c) 創建mariadb用戶，給mariadb用戶讀寫權限
[root@localhost ~]# id mysql id: mysql: no such user # 查找mariadb服務器,mysql用戶的id為27,此處指定同樣的id [root@localhost ~]# useradd -r -u 27 -s /sbin/nologin mysql [root@localhost ~]# setfacl -m u:mysql:rwx /mydata/data/
(2) nfs客戶端(11)
a) 安裝
[root@www ~]# yum -y install nfs-utils
b) 查看共享目錄
[root@www ~]# showmount -e 172.16.0.13 clnt_create: RPC: Port mapper failure - Unable to receive: errno 113 (No route to host) 報錯,關閉服務器的firewalld即可 [root@www ~]# showmount -e 172.16.0.13 Export list for 172.16.0.13: /mydata/data 172.16.0.0/16
c) 創建mariadb數據目錄,并掛載遠程共享目錄
[root@www ~]# mkdir -p /mydata/data [root@www ~]# mount -t nfs 172.16.0.13:/mydata/data /mydata/data [root@www ~]# mount | grep nfs 172.16.0.13:/mydata/data on /mydata/data type nfs4 (rw,relatime,vers=4.0,rsize=65536,wsize=65536,namlen=255,hard,proto=tcp,port=0,timeo=600,retrans=2,sec=sys,clientaddr=172.16.0.11,local_lock=none,addr=172.16.0.13)
二、安裝mariadb和pam_mysql
(1) 安裝mariadb
a) 安裝
[root@www data]# yum -y install mariadb-server
b) 移除默認的數據目錄
[root@www ~]# rm -rf /var/lib/mysql
c) 創建新的數據目錄
nfs下為了測試,已經提前創建好
d) 修改配置文件
[root@www ~]# cd /etc/
[root@www etc]# cp my.cnf{,.bak}
[root@www etc]# vim my.cnf
[mysqld]
datadir=/mydata/data #修改數據目錄
socket=/mydata/data/mysql.sock # 修改socket文件路徑
[mysqladmin] # 需配置此項,否則調用時會找默認的socket文件
socket=/mydata/data/mysql.sock
報錯信息如下:
[root@www ~]# mysqladmin -uroot password "123456"
mysqladmin: connect to server at 'localhost' failed
error: 'Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (2)'
Check that mysqld is running and that the socket: '/var/lib/mysql/mysql.sock' exists!
e) 修改客戶端配置文件
[root@www etc]# vim /etc/my.cnf.d/mysql-clients.cnf [mysql] #修改socket文件路徑 socket=/mydata/data/mysql.sock
f) 初始化數據
[root@www ~]# mysql_install_db --defaults-file=/etc/my.cnf --datadir=/mydata/data --user=mysql 查看數據，已經在nfs目錄中生產數據 [root@www ~]# ls /mydata/data/ aria_log.00000001 aria_log_control mysql performance_schema test
g) 啟動服務
[root@www etc]# systemctl restart mariadb.service
d)設置root密碼
[root@www ~]# mysqladmin -u root password "123456"
g)準備數據庫
[root@www ~]# mysql -uroot -p123456
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 3
Server version: 5.5.52-MariaDB MariaDB Server
Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> CREATE DATABASE vsftpd;
Query OK, 1 row affected (0.09 sec)
MariaDB [(none)]> use vsftpd;
Database changed
MariaDB [vsftpd]> CREATE TABLE users(id int AUTO_INCREMENT NOT NULL PRIMARY KEY,name char(30) NOT NULL,password char(48) binary NOT NULL );
Query OK, 0 rows affected (0.10 sec)
MariaDB [vsftpd]> DESC users;
+----------+----------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+----------+----------+------+-----+---------+----------------+
| id | int(11) | NO | PRI | NULL | auto_increment |
| name | char(30) | NO | | NULL | |
| password | char(48) | NO | | NULL | |
+----------+----------+------+-----+---------+----------------+
3 rows in set (0.00 sec)
MariaDB [vsftpd]> INSERT INTO users(name,password) VALUES('han',password('123456'));
Query OK, 1 row affected (0.02 sec)
MariaDB [vsftpd]> INSERT INTO users(name,password) VALUES('tom',password('123456'));
Query OK, 1 row affected (0.02 sec)
MariaDB [vsftpd]> SELECT * FROM users;
+----+------+-------------------------------------------+
| id | name | password |
+----+------+-------------------------------------------+
| 1 | han | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 |
| 2 | tom | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 |
+----+------+-------------------------------------------+
2 rows in set (0.00 sec)
MariaDB [vsftpd]> GRANT select ON vsftpd.* TO vsftpd@localhost IDENTIFIED BY '123456';
Query OK, 0 rows affected (0.01 sec)
MariaDB [vsftpd]> GRANT select ON vsftpd.* TO vsftpd@'127.0.0.1' IDENTIFIED BY '123456';
Query OK, 0 rows affected (0.00 sec)
MariaDB [vsftpd]> FLUSH PRIVILEGES;
Query OK, 0 rows affected (0.00 sec)
MariaDB [vsftpd]> \q
Bye
測試授權:
[root@www ~]# mysql -uvsftpd -p123456
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 4
Server version: 5.5.52-MariaDB MariaDB Server
Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> SHOW DATABASES;
+--------------------+
| Database |
+--------------------+
| information_schema |
| test |
| vsftpd |
+--------------------+
3 rows in set (0.00 sec)
MariaDB [(none)]> SELECT * FROM users;
ERROR 1046 (3D000): No database selected
MariaDB [(none)]> USE vsftpd;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
MariaDB [vsftpd]> SELECT * FROM users;
+----+------+-------------------------------------------+
| id | name | password |
+----+------+-------------------------------------------+
| 1 | han | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 |
| 2 | tom | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 |
+----+------+-------------------------------------------+
2 rows in set (0.00 sec)
MariaDB [vsftpd]> \q
Bye
注意: mariadb已經初始化完成,現在可以將nfs的no_root_squash屬性去掉了
[root@localhost ~]# vim /etc/exports.d/mydata.exports
/mydata/data 172.16.0.0/16(rw)
[root@localhost ~]# exportfs -r
(2) 安裝pam_mysql
a)安裝開發包組
[root@www ~]# yum -y groupinstall "Development Tools" "Server Platfrom Development" [root@www ~]# yum -y install pam-devel mariadb-devel openssl-devel
b)編譯安裝pam_mysql
[root@www ~]# tar xf pam_mysql-0.7RC1.tar.gz [root@www ~]# cd pam_mysql-0.7RC1 [root@www pam_mysql-0.7RC1]# ./configure --with-mysql=/usr --with-openssl=/usr --with-pam=/usr --with-pam-mods-dir=/usr/lib64/security [root@www pam_mysql-0.7RC1]# make && make install
三、安裝配置配置vsftpd
(1) 安裝
[root@www ~]# yum -y install vsftpd
[root@www ~]# systemctl start vsftpd
[root@www ~]# ss -tnlp | grep :21
LISTEN 0 32 :::21 :::* users:(("vsftpd",pid=21825,fd=3))
(2) 虛擬用戶的賬號存儲在mysql數據庫當中
a) 新建pam配置文件
[root@www ~]# cd /etc/pam.d [root@www pam.d]# vim vsftpd.mysql auth required pam_mysql.so user=vsftpd passwd=123456 host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2 account required pam_mysql.so user=vsftpd passwd=123456 host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=password crpyt=2
b)創建要映射的系統用戶
[root@www pam.d]# useradd -s /sbin/nologin -d /ftproot/ vuser [root@www pam.d]# ls -ld /ftproot/ drwx------ 2 vuser vuser 59 Apr 18 21:30 /ftproot/ # 授權其他用戶讀寫,執行權限 [root@www pam.d]# chmod go+rx /ftproot/ [root@www pam.d]# ls -ld /ftproot/ drwxr-xr-x 2 vuser vuser 59 Apr 18 21:30 /ftproot/
c)修改vsftpd.conf
[root@www pam.d]# vim /etc/vsftpd/vsftpd.conf #指向新的pam文件 pam_service_name=vsftpd.mysql #虛擬用戶 #啟用來賓用戶 guest_enable=YES guest_username=vuser [root@www pam.d]# systemctl restart vsftpd
d)準備ftp目錄
#去除根目錄的寫權限,并創建兩個目錄,其中一個專門用于上傳
[root@www pam.d]# chmod -w /ftproot/
[root@www pam.d]# mkdir /ftproot/{pub,upload}
e) 測試虛擬用戶是否可以登錄
[root@localhost ~]# yum -y install ftp [root@localhost ~]# ftp 172.16.0.11 Connected to 172.16.0.11 (172.16.0.11). 220 (vsFTPd 3.0.2) Name (172.16.0.11:root): tom 331 Please specify the password. Password: 530 Login incorrect. Login failed.
登錄失敗,查看錯誤信息如下:
pam_mysql - MySQL error (Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (2))
郁悶,sock文件好多地方都出錯啊!!!!!
原因: pam_mysql不能讀取msyql主配置文件中的關閉socket的配置,
方法一: 使用默認的/var/lib/mysql/mysql.sock,
方法二: 創建軟連接
這里使用第二種
[root@www pam.d]# mkdir -p /var/lib/mysql [root@www pam.d]# ln -s /mydata/data/mysql.sock /var/lib/mysql/mysql.sock
重新測試:
[root@localhost ~]# ftp 172.16.0.11 Connected to 172.16.0.11 (172.16.0.11). 220 (vsFTPd 3.0.2) Name (172.16.0.11:root): han 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 227 Entering Passive Mode (172,16,0,11,244,12). 150 Here comes the directory listing. drwxr-xr-x 2 0 0 6 Apr 18 14:35 pub drwxr-xr-x 2 0 0 6 Apr 18 14:35 upload 226 Directory send OK. 虛擬帳號登錄ftp成功!!!
f) 給上傳目錄授權并開啟匿名用戶上傳功能
[root@www pam.d]# chown vuser /ftproot/upload/ [root@www pam.d]# ls -ld /ftproot/upload/ drwxr-xr-x 2 vuser root 6 Apr 18 22:35 /ftproot/upload/ [root@www pam.d]# vim /etc/vsftpd/vsftpd.conf anon_upload_enable=YES 重啟服務 [root@www pam.d]# systemctl restart vsftpd
g) 測試虛擬用戶上傳功能:
[root@localhost ~]# ftp 172.16.0.11 Connected to 172.16.0.11 (172.16.0.11). 220 (vsFTPd 3.0.2) Name (172.16.0.11:root): han 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> lcd /etc Local directory now /etc ftp> put fstab local: fstab remote: fstab 227 Entering Passive Mode (172,16,0,11,79,77). 553 Could not create file. ftp> cd upload 250 Directory successfully changed. ftp> put fstab local: fstab remote: fstab 227 Entering Passive Mode (172,16,0,11,189,38). 150 Ok to send data. 226 Transfer complete. 465 bytes sent in 3.7e-05 secs (12567.57 Kbytes/sec) ftp> ls 227 Entering Passive Mode (172,16,0,11,122,90). 150 Here comes the directory listing. -rw------- 1 1003 1004 465 Apr 18 15:20 fstab 226 Directory send OK. 服務端查看 [root@www pam.d]# ls /ftproot/upload/ fstab
經測試: 用戶han可以上傳到upload目錄,但不能上傳到根目錄(沒有權限)
注意： 虛擬用戶映射的是匿名用戶的權限，需開啟匿名用戶上傳功能;
映射的用戶對文件系統需有寫權限
虛擬用戶帳號存儲在mysql數據庫中,/etc/vsftpd/vsftpd.conf配置如下:
#指向新的pam文件 pam_service_name=vsftpd.mysql #虛擬用戶 #啟用來賓用戶 guest_enable=YES guest_username=vuser #虛擬用戶需要開啟匿名用戶的上傳功能 anon_upload_enable=YES
因為莫名原因,以下實驗更改ftp服務器為: 172.16.0.10
(3) 匿名用戶
實現功能: 只允許下載,不允許上傳
a) 查看配置文件,不需要修改
[root@www pam.d]# vim /etc/vsftpd/vsftpd.conf #默認已開啟 anonymous_enable=YES #自定義匿名目錄 anon_root=/ftproot/pub
b) 測試
[root@localhost ~]# lftp 172.16.0.10 lftp 172.16.0.10:~> cd pub/ lftp 172.16.0.10:/pub> ls -rw-r--r-- 1 0 0 0 Apr 18 16:48 test lftp 172.16.0.10:/pub> get test lftp 172.16.0.10:/pub> lcd /etc lcd ok, local cwd=/etc lftp 172.16.0.10:/pub> put fstab put: Access failed: 550 Permission denied. (fstab) lftp 172.16.0.10:/pub> bye [root@localhost ~]# ls anaconda-ks.cfg test
經測試, 可以下載,不能上傳
(4)禁錮所有用戶于其家目錄中
a)修改配置
chroot_local_user=YES
b) 取消用戶對其家目錄的寫權限
[root@localhost pub]# chmod -w /home/centos/
c)測試
[root@localhost ~]# lftp -u centos,123456 172.16.0.10 lftp centos@172.16.0.10:~> ls -rw-r--r-- 1 1001 1001 465 Apr 18 16:43 fstab lftp centos@172.16.0.10:/> cd /etc cd: Access failed: 550 Failed to change directory. (/etc)
將測試,已經鎖定在用戶家目錄,不能切換到其他目錄
(5) 限制并發連接數和匿名用戶的最大傳輸速率
max_clients=200 #限制最大并發連接數 anon_max_rate=512000 #匿名用戶的最大傳輸速率為512KB
(6) 重新啟動服務
[root@localhost pub]# systemctl restart vsftpd
原創文章，作者：hansj，如若轉載，請注明出處：http://www.www58058.com/73728
非常不錯的一篇博客，看得出來，samba和vsftp已完全為你所用了。