AdminSysGNULinux

Cette page est en lecture seule. Vous pouvez afficher le texte source, mais ne pourrez pas le modifier. Contactez votre administrateur si vous pensez qu'il s'agit d'une erreur.
{{tag>Brouillon FS Windows Réseau}}

= Serveur Samba SMB CIFS

Voir aussi 
* [[Samba-client SMB CIFS]]
* https://github.com/cisagov/samba-packer
* ksmbd: un nouveau serveur SMB intégré au noyau (mais problématique de sécurité)



== Notes

RHEL6 ne supporte pas le protocole SMB2 et + 

== Configuration

<code ->
rlimit_max (1024) below minimum Windows limit (16384)
</code>

''/etc/security/limits.d/30-samba.conf''
<code ->
root               -       nofile          16385
</code>

Défaut est ''max open files = 16385''

Voir https://www.tecmint.com/install-samba-on-rhel-8-for-file-sharing-on-windows/

''/etc/samba/smb.conf''
<code ini>
[global]
        workgroup = WORKGROUP
        server string = Samba
        netbios name = SAMBA
        client ipc min protocol = SMB3
        client min protocol = SMB3
        server min protocol = SMB2
        disable netbios = Yes
        disable spoolss = Yes
        domain master = No      
        load printers = No
        local master = No
        log file = /var/log/samba/log.%m
        
        # Size in KB
        max log size = 200000
        
        name resolve order = host
        printcap name = /dev/null
        security = USER
        smb ports = 445
        idmap config * : backend = tdb
        passdb backend = tdbsam
        cups options = raw
        printing = bsd
        #log level = 3
        #restrict anonymous = 2
        #nt pipe support = no
        #interfaces = eth* lo
        #bind interfaces only = yes
        #fstype = Samba
        host msdfs = no
        server services = -s3fs, -rpc, -nbt, -wrepl, -ldap, -cldap, -kdc, -drepl, -winbindd, -ntp_signd, -kcc, -dnsupdate, -dns

[public]
        comment = Public
        read only = Yes
        path = /data/shared/public
                
[shared]
        #guest ok = Yes
        #browseable = No
        comment = Shared
        path = /mnt/shared
        read only = No
        #force user = jean
        valid users = jean
        write list = jean
        
#[IPC$]
#        hosts allow = 192.168.115.0/24 127.0.0.1
#        hosts deny = 0.0.0.0/0
</code>

Nul besoin de redémarrer le service, les modifications sont automatiquement prises en compte.
Pour vérifier

<code bash>
testparm
</code>

Pour tester la connexion
<code bash>
smbclient -N -L 127.0.0.1
smbclient -N //127.0.0.1/shared
smbclient -U user%password //127.0.0.1/shared
</code>



Si besion modifier ''/etc/sysconfig/iptables'' ou **firewalld**

<code bash>
#iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 139 -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 445 -j ACCEPT
</code>




Exemple :

''/etc/samba/smb.conf''
<code ini>
[partage]
   comment = Commentaires...
   path = /var/www
   force user = web
   #valid users = web
   browseable = yes
   writable = yes
</code>

Valider la configuration

<code bash>
testparm
</code>

Reload de la conf sans redémarrer
<code bash>
smbcontrol all reload-config
</code>

Redémarrer le service

<code bash>
systemctl restart smb
</code>


=== Faire un include d'un fichier de config.

C'est une fausse bonne idée car pas de reload automatique


''/etc/samba/smb.conf''
<code ini>
[global]
        path = /dev/null

[includes]
        available = No
        include = /etc/samba/smb.d/shared.conf
</code>

''/etc/samba/smb.d/shared.conf''
<code ini>
[shared]
        comment = Shared
        path = /mnt/shared
        read only = No
</code>		


== Authentification / comptes

Comment c'est configuré
<code bash>
testparm -sv /dev/null | grep auth
</code>

Autoriser un utilisateur / définition du MDP
<code bash>
#pdbedit -a utilisateur
smbpasswd -a utilisateur
</code>

Suppression d'un compte (retour arrière à précédent)
<code bash>
smbpasswd -x supervision
</code>

Liste tous les comptes
<code bash>
pdbedit -L
</code>

Vérif l’existence de l'utilisateur **pirate**
<code bash>
pdbedit -u pirate
</code>


== Désactiver l'impression

''/etc/samba/smb.conf''
<code ini>
[global]
load printers = no
printing = bsd
printcap name = /dev/null
disable spoolss = yes
</code>

Source : http://mugurel.sumanariu.ro/linux/linux-how-to-disable-printing-in-samba/


== Debug


''/etc/samba/smb.conf''
<code ini>
[global]
   log level = 3
</code>

Pas besoin de redémarrer le service, le reload est auto

== Notes

<code bash>
smbstatus
</code>



== Pb

=== Receiving SMB: Server stopped responding - Call returned zero bytes (EOF) opening remote

<code ->
smb: \> get plop
Receiving SMB: Server stopped responding
Call returned zero bytes (EOF) opening remote file \plop
</code>


==== Solution

Le pb venait du fait que la partition ''/var'' était pleine.


=== Pb de connection depuis windows err NT_STATUS_WRONG_PASSWORD


Voir https://bgstack15.wordpress.com/2017/10/01/samba-and-ntlm-for-windows-clients/


==== Solution 1 (insecure)

''/etc/samba/smb.conf''
<code ini>
[global]
ntlm auth = yes
#client ntlmv2 auth = yes
</code>


-----------------------

Exemple de conf 

Install sous RedHat / CentOS

<code bash>
cp -p /etc/samba/smb.conf /etc/samba/smb.conf.bak
egrep -v '^$|^#|^;' /etc/samba/smb.conf.bak > /etc/samba/smb.conf
</code>

''/etc/samba/smb.conf''
<code ini>
[global]
   workgroup = WORKGROUP
   dns proxy = no
   log file = /var/log/samba/log.%m
   max log size = 1000
   syslog = 0
   panic action = /usr/share/samba/panic-action %d
   server role = standalone server
   passdb backend = tdbsam
   obey pam restrictions = yes
   unix password sync = yes
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
   pam password change = yes
   map to guest = bad user
   usershare allow guests = yes

[tmp]
   path = /tmp
   comment = TEMP
   browseable = yes
   read only = no
   create mask = 0660
   directory mask = 0770
   guest ok = yes
   
[partage]
   comment = Partage
   path = /data/
   force user = utilisateur1
   #public = yes
   valid users = @groupe1, jean
   write list = @groupe1, jean
   browseable = yes
   writable = yes
   read only = no
</code>


== Autres

Pour conteneurs

<code bash>
/usr/sbin/smbd -F -S
</code>