[拼凑]samba简明手册

陈小奚

Samba简明手册

Illusion Chen

Samba简介

Samba是Andrew Tridgell在1991年（和Linux诞生的时间接近）编写的，当时他想在他的DOS客户机上mount Unix server的磁盘，但他发现无法同时使用Sun的NFS协议，于是，连Socket（套接字）都不熟悉的他开始尝试自己在PC机上实现NFS，经过不断摸索，他开发了一个包监听程序来反向解析SMB协议，终于在自己的计算机上实现了NFS Mount。到1992年1月，他完成了0.1版，称为Server 0.1。但由于得到了X终端，他放弃了进一步的开发。直到1994年底， Andrew Tridgell需要在Windows PC连接Linux系统，Adrew Tridgell才重新开始在Linux上开发Samba，以支持Windows的改变，增加了对ACL、LDAP协议、Windows DFS文件系统、信任关系等方面的支持。
（简单来说，安装samba之后可使Unix/linux server支持NetBIOS/NetBEUI协议的通信方式。）

Samba服务做什么
* 在网络上共享文件目录，就像文件服务器。
* 在网络上共享打印机。
* 提供部分类似Windows PDC的用户安全控制功能。包括域,信任关系等.

Samba下载安装

Samba下载站点：
http://www.samba.org
ftp://ftp.samba.org
http://sunfreeware.com
Samba的可下载版本包括二进制程序binary package、源码版本。下载回来的压缩包一般需要用gunzip,tar来解压缩包。有的包在解压缩后即可通过运行一个script来自动编译生成软件包，然后通过packageadd –d来安装samba了。在solaris下，samba通常被安装在/usr/local/samba下。

安装
./configure (- -help/- -prefix=/dir)
./make (需要gcc等编译工具或lib包等)
./make install

启动Samba

一般在安装samba包后,会在/etc/rc2.d目录下建立一个启动脚本.如果没有,那我们也可以创建一个script，主要是做samba,smbd,nmbd的启动.

1. #!/bin/sh
   
2. # ident  "@(#)samba.server 1.0   96/06/19 TK"    /* SVr4.0 1.1.13.1*/
   
3. #
   
4. # Please send info on modifications to knuutila@cs.utu.fi
   
5. #
   
6. # Changed 20031008
   
7. # This file should have uid root, gid sys and chmod 744
   
8. #
   
9. ulimit -n 1024
   
10. if [ ! -d /usr/bin ]
    
11. then                    # /usr not mounted
    
12.         exit
    
13. fi
    
14. 
    
15. killproc() {            # kill the named process(es)
    
16.         pid=`/usr/bin/ps -e |
    
17.              /usr/bin/grep -w $1 |
    
18.              /usr/bin/sed -e 's/^  *//' -e 's/ .*//'`
    
19.         [ "$pid" != "" ] && kill $pid
    
20. }
    
21. 
    
22. # Start/stop processes required for samba server
    
23. 
    
24. case "$1" in
    
25. 
    
26. 'start')
    
27. #
    
28. # Edit these lines to suit your installation (paths, workgroup, host)
    
29. #
    
30.    /usr/local/samba/bin/smbd -D
    
31.    /usr/local/samba/bin/nmbd -D
    
32.    echo "Samba services started"
    
33.    ;;
    
34. 'stop')
    
35.    killproc nmbd
    
36.    killproc smbd
    
37.    echo "Samba services stopped"
    
38.    ;;
    
39. *)
    
40.    echo "Usage: /etc/init.d/samba.server { start | stop }"
    
41.    ;;
    
42. esac
    

复制代码

将它保存在/etc/rc2.d或/etc/rc3.d下，命名为S99samba.server即可。

配置Samba

1，        安全级别
samba的安全级别通常有三种：share、user/server、domain。
Share的级别最宽松，不需要用户名和密码。User则需要用户名和密码，server是把安全验证任务交给另一个samba/NT server。而domain则是windows的域安全级别。

2，        smbpasswd
smbpasswd是samba服务的一部分，当root执行smbpasswd时，它可以添加删除samba用户，或改变用户的属性。当标准用户执行smbpasswd时，它可以改变或加密密码。由于当smbpasswd被标准用户运行时是作为客户端，所以smbd必须运行。
Smbpasswd使用的散列加密算法是很脆弱的，所以我们必须对smbpasswd文件及其所在的目录加以限制，使之成为仅root可读写，以保证其安全性。

3，        域安全级别
samba server可以创建或加入域。
在加入域的时候，我们先在NT PDC上加入samba server的NetBIOS名字，成为合法帐号。在samba server上，停止samba服务，执行smbpasswd –j domain –r pdc，将samba server加入域。在成功加入域后，会提示如下信息：smbpasswd: Joined domain xxx，同时在smbpasswd文件所在目录添加一个机器帐号文件，文件名格式为domain.sambaserver.mac.
在重新启动samba进程前，我们必须编辑smb.conf
security = domain
workgroup = domain
encrypt password = yes
password server=domainPDC1 domainPDC2
samba server在加入NT域后即可对NT用户验证，不过，samba需要将NT用户映射到unix UID。
方法一：user map = /dir/file；指定一个映射文件，如文件中描述root = administrator admin，则用户administrator/admin访问时作为root看待。
方法二：将NT用户迁移到unix上来。由于只是需要一个合法的UID，所以可以锁定用户密码，将其shell环境设为空或/bin/false。（也可以通过结合LDAP来同步windows和unix帐户。）

4，SWAT
SWAT是samba默认安装的组件。其默认端口是901，可以通过web浏览方式来对samba进行简单的配置。配置的结果将保存在smb.conf中。但是对于较高的安全性和个性化需求，我们必须直接编辑smb.conf。

4，        Smb.conf
通常smb.conf被放在/usr/local/samba/lib下。它的内容格式为“参数=值”，以；或#为注释。除了[global]被作为全局参数外，[homes]，[printers]等其他的段都可以看作共享资源。在配置完成之后，可以运行testpram来测试smb.conf是否配制正确。

[global]:
workgroup = MYGROUP
定义该Samba服务器所在的工作组或者域（如果下面的security=domain的话）。
server string = MY Samba Server
设定机器的描述，当我们通过网络邻居访问的时候可以在备注里面看见这个内容，而且还可以使用samba设定的变量。这里说一下samba定义的变量：
%S = 当前服务名（如果有的话）
%P = 当前服务的根目录（如果有的话）
%u = 当前服务的用户名（如果有的话）
%g = 当前用户说在的主工作组
%U = 当前对话的用户名
%G = 当前对话的用户的主工作组
%H = 当前服务的用户的Home目录
%v = Samba服务的版本号。
%h = 运行Samba服务机器的主机名
%m = 客户机的NETBIOS名称
%L = 服务器的NETBIOS名称
%M = 客户机的主机名
%N = NIS服务器名
%p = NIS服务的Home目录
%R = 说采用的协议等级(值可以是CORE, COREPLUS, LANMAN1, LANMAN2，NT1)
%d = 当前服务进程的ID
%a = 客户机的结构（只能识别几项：Samba，WfWg，WinNT，Win95）
%I = 客户机的IP
%T = 当前日期和时间
hosts allow = 网络或者主机
这里可以设置允许访问的网络和主机IP，比如允许192.168.1.0/24和192.168.2.1/32访问，就用host allow = 192.168.1. 192.168.2.1 127.0.0.1(网络注意后面加”.”号，各个项目间用空格隔开，记得把本机也加进去)
printcap name = printcapFile
到printcapFile（一般是/etc/printcap）这个文件中取得打印机的描述信息
load printers = yes/no
设定是否自动共享打印机而不用设置下面的[printer]一节的相关东西
printing = PrintSystemType
定义打印系统的类型，缺省是lprng,可选项有：bsd, sysv, plp, lprng, aix, hpux, qnx。
guest account = pcguest
定义游客帐号，而且需要把这个帐号加入/etc/passwd。
如不定义它就用缺省的nobody
log file = LogFileName
定义记录文件的位置LogFileName（一般是用/var/log/samba/%m.log）
max log size = size
定义记录文件的大小size（单位是KB，如果是0的话就不限大小）
security = security_level
定义Samba的安全级别，按从低到高分为四级：share，user，server，domain。它们对应的验证方式如下：
share: 没有安全性的级别，任何用户都可以不要用户名和口令访问服务器上的资源。
user: samba的默认配置，要求用户在访问共享资源之前资源必须先提供用户名和密码进行验证。
server: 和user安全级别类似，但用户名和密码是递交到另外一个服务器去验证，比如递交给一台NT服务器。如果递交失败，就退到user安全级。
domain: 这个安全级别要求网络上存在一台Windows的主域控制器，samba把用户名和密码递交给它去验证。
后面三种安全级都要求用户在unix机器上也要系统帐户。否则是不能访问的。
password server = <NT-Server-Name>;
当前面的security设定为server或者domain的时候才有必要设定它。
password level = n
这是设定针对一些SMB客户像OS/2之类而设的，这样的系统在发送用户密码的时候，会把密码转换成大写再发送，这样就和samba的密码不一致，这个参数可以设定密码里允许的大写字母个数，这样samba就根据这个数目对接收到的密码进行大小写重组，以重组过的密码尝试验证密码的正确性。n越大，组合的次数就越多，验证时间就越长，安全性也会因此变得越低。例如n=2，用户的密码是abcd，但发送出去其实是ABCD，samba就会把这个ABCD进行大小写重组，组合后的结果可以是: Abcd, aBcd, abCd, abcD, abcd, ABcd, AbCd, AbcD,aBCd,aBcD,abCD。
所以如果没有必要，就把n定为是零。这样的话samba只尝试两次，一个是接收到的密码，另一个尝试的是这个密码都是小写的情况。
username level = n
这个是对于用户名的情况，说明和上面一项类似。
encrypt passwords = yes/no
设置是否对密码进行加密，samba本身有一个密码文件/etc/samba/smbpasswd，如果不对密码进行加密则在验证会话期间客户机和服务器之间传递的是明文密码，samba直接把这个密码和Linux里的/etc/samba/smbpasswd密码文件进行验证。但是在Windows 95 OS/R2以后的版本和Windows NT SP3以后的版本缺省都不传送明文密码，要让这些系统能传送明文密码必须在其注册表里更改，比较麻烦，好的方法就是把这里的这个开关设置为yes。
smb passwd file = smbPasswordFile
设置存放samba用户密码的文件smbPasswordFile(一般是/etc/samba/smbpasswd)。
ssl CA certFile = sslFile
当samba编译的时候支持SSL的时候，需要指定SSL的证书的位置（一般在/usr/share/ssl/certs/ca-bundle.crt）。
unix password sync = yes/no
passwd program = /usr/bin/passwd %u
passwd chat = *New*UNIX*password* %n
*ReType*new*UNIX*password* %n
*passwd:*all*authentication*tokens*updated*successfully*
这三项设置能否从windows的应用程序修改unix系统的用户密码
username map = UsermapFile
指定用户映射文件（一般是/etc/samba/smbusers），当我们在这个文件里面指定一行root = administrator admin的时候，客户机的用户是admin或者administrator连接时会被当作用户root看待。
include = MachineConfFile
指定对不同机器的连接采用不同的配置文件MachineConfFile（一般为了灵活管理使用/etc/samba/smb.conf.%m，由于采用了samba的变量，把配置文件和客户机的NETBIOS名称关联起来，能很容易地控制这些客户机的权限和设置）。
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
这个是网络socket方面的一些参数，能实现最好的文件传输性能。
相关的选项还有SO_KEEPALIVE、SO_REUSEADDR、SO_BROADCAST、IPTOS_LOWDELAY、IPTOS_THROUGHPUT、SO_SNDLOWAT（*）、SO_RCVLOWAT（*），带*号的要指定数值。一般如果在本地网络，就只用IPTOS_LOWDELAY，如果是有一个本地网络的，就用IPTOS_LOWDELAY TCP_NODELAY，如果是广域网络，就试试IPTOS_THROUGHPUT。
interfaces = interface1 interface2
如果有多个网络接口，就必须在这里指定。如interface = 192.168.12.2/24 192.168.13.2/24
remote browse sync = host(subnet)
这里指定浏览列表同步信息从哪里取得， 如果用host（比如192.168.3.25）或者整个子网（192.168.5.255）。
---------------------------------------------------------------------------------------------------------------------
*什么是浏览（Browse）：
在SMB协议中，计算机为了访问网络资源，就需要了解网络上存在的资源列表（例如在Windows下使用网络邻居查看可以访问的计算机），这个机制就被称为浏览（Browse）。虽然SMB协议中经常使用广播的方式，但如果每次都使用广播的方式了解当前的网络资源（包括提供服务的计算机和各个计算机上的服务资源），就需要消耗大量的网络资源和浪费较长的查找时间，因此最好在网络中维护一个网络资源的列表，以方便查找网络资源。只有必要的时候，才重新查找资源，例如使用Windows下的查找计算机功能。
　　但没有必要每个计算机都维护整个资源列表，维护网络中当前资源列表的任务由网络上的几个特殊计算机完成的，这些计算机被称为Browser，这些Browser通过记录广播数据或查询名字服务器来记录网络上的各种资源。
Browser并不是事先指定的计算机，而是在普通计算机之间通过自动进行的推举产生的。不同的计算机可以按照其提供服务的能力，设置在推举时具备的不同权重。为了保证一个Browser停机时网络浏览仍然正常，网络中常常存在多个Browser，一个为主Browser（Master Browser），其他的为备份Browser。
---------------------------------------------------------------------------------------------------------------------
remote announce = host(subnet)
指定这些机器向网络宣告自己，而不是有Browser得到。
local master = yes/no
这个参数指定nmbd是否试图成为本地主浏览器，默认值是yes，如果设为no则samba服务器就永远都不会成为本地主浏览器。但即使设置了yes，也不等于samba服务器就会成为本地主浏览器。只是参与本地主浏览器选择。
os level = n
n的值是个整数，决定了nmbd是否有机会成为本地广播区域的工作组里的本地主浏览器，默认值是零，零则意味着nmbd失去浏览选择。如果要nmbd更有机会成为本地主浏览器的话，可以设为65。
domain master = yes/no
这个参数让nmbd成为一个域浏览器，取得各本地主浏览器的浏览列表，并将整个域的浏览列表递交给各本地主浏览器。
preferred master = yes/no
这个参数指定nmbd是否是工作组里的首要的主浏览器，如果指定为yes，nmbd在启动的时候就强制一个浏览选择。
--------------------------------------------------------------------------------------------------------------------
Domain master和local master
工作组和域这两个概念在进行浏览时具备同样的用处，都是用于区分并维护同一组浏览数据的多个计算机。事实上他们的不同在于认证方式上，工作组中每台计算机都基本上是独立的，独立对客户访问进行认证，而域中将存在一个（或几个）域控制器，保存对整个域中都有效的认证信息，包括用户的认证信息以及域内成员计算机的认证信息。浏览数据的时候，并不需要认证信息，Microsoft将工作组扩展为域，只是为了形成一种分级的目录结构，将原有的浏览和目录服务相结合，以扩大Mircrosoft网络服务范围的一种策略。
工作组和域都可以跨越多个子网，因此网络中就存在两种Browser，一种为Domain Master Browser，用于维护整个工作组或域内的浏览数据，另一种为Local Master Browser，用于维护本子网内的浏览数据，它和Domain Master Browser通信以获得所有的可浏览数据。划分这两种Browser 主要是由于浏览数据依赖于本地网广播来获得资源列表，不同子网之间只能通过浏览器之间的交流能力，才能互相交换资源列表。
但是，为了浏览多个子网的资源，必须使用NBNS名字服务器的解析方式，没有NBNS的帮助，计算机将不能获得子网外计算机的NetBIOS名字。Local Master Browser也需要查询NetBIOS名字服务器以获得Domain Master Browser的名字，以相互交换网络资源信息。
由于域控制器在域内的特殊性，因此域控制器倾向于被用做Browser，主域控制器应该被用作Domain Master Browser，他们在推举时设置的权重较大。
----------------------------------------------------------------------------------------------------------------------
preserve case = yes/no
short preserve case = yes/no
指定拷贝DOS文件的时候保持大小写，缺省是no
default case = lower/upper
所有的DOS文件的缺省是大写还是小写
case sensitive = yes/no
大小写敏感，一般是no,不然会出现一些问题。
共享设置：
共享资源:
每个SMB服务器能对外提供文件或打印服务，每个共享资源需要被给予一个共享名，这个名字将显示在这个服务器的资源列表中。如果一个资源的名字的最后一个字母为$，则这个共享名就为隐藏共享，不能直接表现在浏览列表中，而只能通过直接访问这个名字来进行访问。在SMB协议中，为了获得服务器提供的资源列表，必须使用一个隐藏的资源名字IPC$来访问服务器，否则客户无法获得系统资源的列表。
--------------------------------------------------------------------------------------------------------------------
[homes]，在smb.conf文件中一般没有对这个目录的设定特定内容比如路径等。
当客户机发出服务请求时，就在smb.conf文件的其它部分查找特定内容的服务。如果没有发现这些服务，并且提供了homes段时，那么就搜索密码文件得到用户的Home目录。通过Homes段，Samba可以得到用户的Home目录并使之共享。
下面是这个段的最基本的几个设置。
[homes]
comment=Home Directory
browseable=no
writable=yes
比较正常的共享的配置如下例：
[MyShare]
comment = grind’s file
path = /home/grind
allow hosts = host(subnet)
deny hosts = host(subnet)
writable = yes/no
user = user(@group)
valid users = user(@group)
invalid users = user(@group)
read list = user(@group)
write list = user(@group)
admin list = user(@group)
public = yes/no
hide dot files = yes/no
create mode = 0755
directory mode = 0755
sync always = yes/no
short preserve case = yes/no
preserve case = yes/no
case sensitive = yes/no
mangle case = yes/no
default case = upper/lower
force user = grind
wide links = yes/no
max connections = 100
delete readonly = yes/no
其中[]里面的MyShare指定共享名，一般就是网络邻居里面可以看见的文件夹的名字。
comment指的是对改共享的备注。
path指定共享的路径，其中可以配合samba变量使用。比如你可以指定path=/data/%m，这样如果一台机器的NETBIOS名字是grind,它访问MyShare这个共享的时候就是进入/data/grind目录,而对于NETBIOS名是glass的机器，则进入/data/glass目录。
allow hosts和deny hosts和前面的全局设置的方法一样这里不再提及。
writeable指定了这个目录缺省是否可写，也可以用readonly = no来设置可写。
user设置所有可能使用该共享资源的用户，也可以用@group代表group这个组的所有成员，不同的项目之间用空格或者逗号隔开。
valid users指定能够使用该共享资源的用户和组。
invalid users指定不能够使用该共享资源的用户和组。
read list 指定只能读取该共享资源的用户和组。
write list指定能读取和写该共享资源的用户和组。
admin list指定能管理该共享资源（包括读写和权限赋予等）的用户和组。
public指明该共享资源是否能给游客帐号访问，这个开关有时候也叫guest ok，所以有的配置文件中出现guest ok = yes其实和public = yes是一样的。
hide dot files指明是不是像unix那样隐藏以“.”号开头的文件。
create mode指明新建立的文件的属性，一般是0755。
directory mode指明新建立的目录的属性，一般是0755。
sync always指明对该共享资源进行写操作后是否进行同步操作。
short preserve case指明不管文件名大小写。
preserve case指明保持大小写。
case sensitive指明是否对大小写敏感，一般选no,不然可能引起错误。
mangle case指明混合大小写。
default case指明缺省的文件名是全部大写还是小写。
force user强制把建立文件的属主是谁。如果我有一个目录，让guest可以写，那么guest就可以删除，如果我用force user= grind强制建立文件的属主是grind，同时限制create mask = 0755，这样guest就不能删除了。
wide links指明是否允许共享外符号连接，比如共享资源里面有个连接指向非共享资源里面的文件或者目录，如果设置wide links = no将使该连接不可用。
max connections = n设定同时连接数是n。
delete readonly指明能否删除共享资源里面已经被定义为只读的文件。
有两类特殊的共享，分别是光驱和打印机
光驱的共享设置:
[cdrom]
comment = grind’s cdrom
path = /mnt/cdrom
public = yes
browseable = yes
root preexec = /bin/mount -t iso9660 /dev/cd0 /mnt/cdrom
root postexec = /bin/umount /mnt/cdrom
这里root preexec指明了连接时用root的身份运行mount命令，而root postexec则指明了断开时用root身份运行umount,有效实现了对光驱的共享。
打印机共享的设置：
[printers]
path = /var/spool/samba
writeable = no
guest ok = yes
printable = yes
printer driver = HP LaserJet 5L
这里printable指明该打印机可以打印， guest ok说明guest帐户也能打印，path指明打印的临时文件队列放到/var/spool/samba目录下。printer driver的作用是指明该打印机的类型，这样我们在安装网络打印机的时候可以直接自动安装驱动而不必选择。

Smb.conf sample

Sample I: (solaris 8/Win nt domain)

1. 
   
2. # this is the main Samba configuration file. You should read the
   
3. # smb.conf(5) manual page in order to understand the options listed
   
4. # here. Samba has a huge number of configurable options (perhaps too
   
5. # many!) most of which are not shown in this example
   
6. #
   
7. # Any line which starts with a ; (semi-colon) or a # (hash)
   
8. # is a comment and is ignored. In this example we will use a #
   
9. # for commentry and a ; for parts of the config file that you
   
10. # may wish to enable
    
11. #
    
12. # NOTE: Whenever you modify this file you should run the command "testparm"
    
13. # to check that you have not many any basic syntactic errors.
    
14. #
    
15. #======================= Global Settings =====================================
    
16. [global]
    
17.    debug level = 0
    
18.    admin users = root
    
19.    netbios name = ufszx01
    
20. 
    
21. # workgroup = NT-Domain-Name or Workgroup-Name
    
22. ;   workgroup = MYGROUP
    
23.    workgroup = UFSZX
    
24. 
    
25. # Server string is the equivalent of the NT Description field
    
26. ;   server string = Samba Server
    
27.    server string = Samba Server on ufszx01
    
28. 
    
29. # This option is important for security. It allows you to restrict
    
30. # connections to machines which are on your local network. The
    
31. # following example restricts access to two C class networks and
    
32. # the "loopback" interface. For more examples of the syntax see
    
33. # the smb.conf man page
    
34. ;   hosts allow = 192.168.1. 192.168.2. 127.
    
35.    hosts allow = 192.168.8. 192.168.19.
    
36. 
    
37. 
    
38. # If you want to automatically load your printer list rather
    
39. # than setting them up individually then you'll need this
    
40.    load printers = yes
    
41. 
    
42. # you may wish to override the location of the printcap file
    
43. ;   printcap name = /etc/printcap
    
44. 
    
45. # on SystemV system setting printcap name to lpstat should allow
    
46. # you to automatically obtain a printer list from the SystemV spool
    
47. # system
    
48. ;   printcap name = lpstat
    
49.    printcap name = lpstat
    
50. 
    
51. # It should not be necessary to specify the print system type unless
    
52. # it is non-standard. Currently supported print systems include:
    
53. # bsd, sysv, plp, lprng, aix, hpux, qnx
    
54. ;   printing = bsd
    
55. 
    
56. # Uncomment this if you want a guest account, you must add this to /etc/passwd
    
57. # otherwise the user "nobody" is used
    
58. ;  guest account = pcguest
    
59. 
    
60. # this tells Samba to use a separate log file for each machine
    
61. # that connects
    
62.    log file = /usr/local/samba/var/log.%m
    
63. 
    
64. # Put a capping on the size of the log files (in Kb).
    
65.    max log size = 50
    
66. 
    
67. # Security mode. Most people will want user level security. See
    
68. # security_level.txt for details.
    
69. ;   security = user
    
70. #   security = server
    
71.    security = share
    
72. 
    
73. # Use password server option only with security = server
    
74. ;   password server = <NT-Server-Name>;
    
75. password server = ufszxnt01
    
76. 
    
77. # Password Level allows matching of _n_ characters of the password for
    
78. # all combinations of upper and lower case.
    
79. ;  password level = 8
    
80. 
    
81. # You may wish to use password encryption. Please read
    
82. # ENCRYPTION.txt, Win95.txt and WinNT.txt in the Samba documentation.
    
83. # Do not enable this option unless you have read those documents
    
84. ;  encrypt passwords = yes
    
85. 
    
86. # Unix users can map to different SMB User names
    
87. ;  username map = /etc/smbusers
    
88. 
    
89. # Using the following line enables you to customise your configuration
    
90. # on a per machine basis. The %m gets replaced with the netbios name
    
91. # of the machine that is connecting
    
92. ;   include = /usr/local/samba/lib/smb.conf.%m
    
93. 
    
94. # Most people will find that this option gives better performance.
    
95. # See speed.txt and the manual pages for details
    
96.    socket options = TCP_NODELAY
    
97. 
    
98. # Configure Samba to use multiple interfaces
    
99. # If you have multiple network interfaces then you must list them
    
100. # here. See the man page for details.
     
101. ;   interfaces = 192.168.12.2/24 192.168.13.2/24
     
102. 
     
103. # Configure remote browse list synchronisation here
     
104. #  request announcement to, or browse list sync from:
     
105. #       a specific host or from / to a whole subnet (see below)
     
106. ;   remote browse sync = 192.168.3.25 192.168.5.255
     
107. # Cause this host to announce itself to local subnets here
     
108. ;   remote announce = 192.168.1.255 192.168.2.44
     
109. 
     
110. # Browser Control Options:
     
111. # set local master to no if you don't want Samba to become a master
     
112. # browser on your network. Otherwise the normal election rules apply
     
113. ;   local master = no
     
114. 
     
115. # OS Level determines the precedence of this server in master browser
     
116. # elections. The default value should be reasonable
     
117. ;   os level = 33
     
118. 
     
119. # Domain Master specifies Samba to be the Domain Master Browser. This
     
120. # allows Samba to collate browse lists between subnets. Don't use this
     
121. # if you already have a Windows NT domain controller doing this job
     
122. ;   domain master = yes
     
123. 
     
124. # Preferred Master causes Samba to force a local browser election on startup
     
125. # and gives it a slightly higher chance of winning the election
     
126. ;   preferred master = yes
     
127. 
     
128. # Use only if you have an NT server on your network that has been
     
129. # configured at install time to be a primary domain controller.
     
130. ;   domain controller = <NT-Domain-Controller-SMBName>;
     
131.         ;domain controller = exhkg
     
132. 
     
133. # Enable this if you want Samba to be a domain logon server for
     
134. # Windows95 workstations.
     
135. ;   domain logons = yes
     
136. 
     
137. # if you enable domain logons then you may want a per-machine or
     
138. # per user logon script
     
139. # run a specific logon batch file per workstation (machine)
     
140. ;   logon script = %m.bat
     
141. # run a specific logon batch file per username
     
142. ;   logon script = %U.bat
     
143. 
     
144. # Where to store roving profiles (only for Win95 and WinNT)
     
145. #        %L substitutes for this servers netbios name, %U is username
     
146. #        You must uncomment the [Profiles] share below
     
147. ;   logon path = \\%L\Profiles\%U
     
148. 
     
149. # Windows Internet Name Serving Support Section:
     
150. # WINS Support - Tells the NMBD component of Samba to enable it's WINS Server
     
151. ;   wins support = yes
     
152.    wins support = yes
     
153. 
     
154. # WINS Server - Tells the NMBD components of Samba to be a WINS Client
     
155. #       Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
     
156. ;   wins server = w.x.y.z
     
157. 
     
158. 
     
159. # WINS Proxy - Tells Samba to answer name resolution queries on
     
160. # behalf of a non WINS capable client, for this to work there must be
     
161. # at least one  WINS Server on the network. The default is NO.
     
162. ;   wins proxy = yes
     
163. 
     
164. # DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
     
165. # via DNS nslookups. The built-in default for versions 1.9.17 is yes,
     
166. # this has been changed in version 1.9.18 to no.
     
167.    dns proxy = no
     
168. 
     
169. # Case Preservation can be handy - system default is _no_
     
170. # NOTE: These can be set on a per share basis
     
171. ;  preserve case = no
     
172. ;  short preserve case = no
     
173. # Default case is normally upper case for all DOS files
     
174. ;  default case = lower
     
175. # Be very careful with case sensitivity - it can break things!
     
176. ;  case sensitive = no
     
177. 
     
178.    time server = true
     
179. 
     
180. #============================ Share Definitions ==============================
     
181. [homes]
     
182.    comment = Home Directories
     
183.    browseable = no
     
184.    writable = yes
     
185. 
     
186. # Un-comment the following and create the netlogon directory for Domain Logons
     
187. ;[netlogon]
     
188. ;   comment = Network Logon Service
     
189. ;   path = /usr/local/samba/lib/netlogon
     
190. ;   guest ok = yes
     
191. ;   writable = no
     
192. ;   share modes = no
     
193. 
     
194. 
     
195. # Un-comment the following to provide a specific roving profile share
     
196. # the default is to use the user's home directory
     
197. ;[Profiles]
     
198. ;    path = /usr/local/samba/profiles
     
199. ;    browseable = no
     
200. ;    guest ok = yes
     
201. 
     
202. 
     
203. # NOTE: If you have a BSD-style print system there is no need to
     
204. # specifically define each individual printer
     
205. [printers]
     
206.    comment = All Printers
     
207.    path = /usr/spool/samba
     
208.    browseable = no
     
209. # Set public = yes to allow user 'guest account' to print
     
210.    guest ok = yes
     
211.    writable = no
     
212.    printable = yes
     
213. 
     
214. # This one is useful for people to share files
     
215. [tmp]
     
216.    comment = Temporary file space
     
217.    path = /tmp
     
218.    read only = no
     
219.    public = yes
     
220. 
     
221. # A publicly accessible directory, but read only, except for people in
     
222. # the "staff" group
     
223. ;[public]
     
224. ;   comment = Public Stuff
     
225. ;   path = /home/samba
     
226. ;   public = yes
     
227. ;   writable = yes
     
228. ;   printable = no
     
229. ;   write list = @staff
     
230. 
     
231. # Other examples.
     
232. #
     
233. # A private printer, usable only by fred. Spool data will be placed in fred's
     
234. # home directory. Note that fred must have write access to the spool directory,
     
235. # wherever it is.
     
236. ;[fredsprn]
     
237. ;   comment = Fred's Printer
     
238. ;   valid users = fred
     
239. ;   path = /homes/fred
     
240. ;   printer = freds_printer
     
241. ;   public = no
     
242. ;   writable = no
     
243. ;   printable = yes
     
244. 
     
245. # A private directory, usable only by fred. Note that fred requires write
     
246. # access to the directory.
     
247. ;[fredsdir]
     
248. ;   comment = Fred's Service
     
249. ;   path = /usr/somewhere/private
     
250. ;   valid users = fred
     
251. ;   public = no
     
252. ;   writable = yes
     
253. ;   printable = no
     
254. 
     
255. # a service which has a different directory for each machine that connects
     
256. # this allows you to tailor configurations to incoming machines. You could
     
257. # also use the %U option to tailor it by user name.
     
258. # The %m gets replaced with the machine name that is connecting.
     
259. ;[pchome]
     
260. ;  comment = PC Directories
     
261. ;  path = /usr/pc/%m
     
262. ;  public = no
     
263. ;  writable = yes
     
264. 
     
265. # A publicly accessible directory, read/write to all users. Note that all files
     
266. # created in the directory by users will be owned by the default user, so
     
267. # any user with access can delete any other user's files. Obviously this
     
268. # directory must be writable by the default user. Another user could of course
     
269. # be specified, in which case all files would be owned by that user instead.
     
270. ;[public]
     
271. ;   path = /usr/somewhere/else/public
     
272. ;   public = yes
     
273. ;   only guest = yes
     
274. ;   writable = yes
     
275. ;   printable = no
     
276. 
     
277. # The following two entries demonstrate how to share a directory so that two
     
278. # users can place files there that will be owned by the specific users. In this
     
279. # setup, the directory should be writable by both users and should have the
     
280. # sticky bit set on it to prevent abuse. Obviously this could be extended to
     
281. # as many users as required.
     
282. ;[myshare]
     
283. ;   comment = Mary's and Fred's stuff
     
284. ;   path = /usr/somewhere/shared
     
285. ;   valid users = mary fred
     
286. ;   public = no
     
287. ;   writable = yes
     
288. ;   printable = no
     
289. ;   create mask = 0765
     
290. 
     
291. [HP]
     
292.    path = /usr/spool/samba
     
293.    read only = No
     
294.    guest ok = Yes
     
295.    print ok = Yes
     
296.    share modes = No
     
297.    oplocks = No
     
298.    printer = HP
     
299. 
     
300. [LOG]
     
301.    comment = LOG
     
302.    path = /icil/log/pc
     
303.    guest ok = yes
     
304.    writeable = yes
     
305.    create mode = 0666
     
306. 
     
307. ;[TRAXON]
     
308. ;   comment = TRAXON
     
309. ;   path = /var/spool/uucppublic/traxon
     
310. ;   guest ok = yes
     
311. ;   writeable = yes
     
312. ;   create mode = 0777
     
313. 
     
314. [TMP]
     
315.    comment = TMP
     
316.    path = /tmp
     
317.    guest ok = yes
     
318. 
     
319. [CDROM]
     
320.    comment = CDROM
     
321.    path = /cdrom
     
322.    guest ok = yes
     

复制代码

Sample II: （linux/ act as a PDC）

1. 
   
2. # This is the main Samba configuration file. You should read the
   
3. # smb.conf(5) manual page in order to understand the options listed
   
4. # here. Samba has a huge number of configurable options (perhaps too
   
5. # many!) most of which are not shown in this example
   
6. #
   
7. # Any line which starts with a ; (semi-colon) or a # (hash)
   
8. # is a comment and is ignored. In this example we will use a #
   
9. # for commentry and a ; for parts of the config file that you
   
10. # may wish to enable
    
11. #
    
12. # NOTE: Whenever you modify this file you should run the command "testparm"
    
13. # to check that you have not made any basic syntactic errors.
    
14. #
    
15. #======================= Global Settings =====================================
    
16. [global]
    
17. 
    
18. # workgroup = NT-Domain-Name or Workgroup-Name
    
19.    workgroup = UFCMB
    
20.    netbios name = ufcmblx01
    
21. 
    
22. # server string is the equivalent of the NT Description field
    
23.    server string = UFCMB Samba PDC Server
    
24. 
    
25. 
    
26. # This option is important for security. It allows you to restrict
    
27. # connections to machines which are on your local network. The
    
28. # following example restricts access to two C class networks and
    
29. # the "loopback" interface. For more examples of the syntax see
    
30. # the smb.conf man page
    
31. ;   hosts allow = 192.168.1. 192.168.2. 127.
    
32. 
    
33. # if you want to automatically load your printer list rather
    
34. # than setting them up individually then you'll need this
    
35. ;  printcap name = /etc/printcap
    
36.   load printers = no
    
37. 
    
38. # It should not be necessary to spell out the print system type unless
    
39. # yours is non-standard. Currently supported print systems include:
    
40. # bsd, sysv, plp, lprng, aix, hpux, qnx
    
41.   ; printing = bsd
    
42. 
    
43. # Uncomment this if you want a guest account, you must add this to /etc/passwd
    
44. # otherwise the user "nobody" is used
    
45. ; guest account = pcguest
    
46. 
    
47. # this tells Samba to use a separate log file for each machine
    
48. # that connects
    
49.    log file = /var/log/samba/log.%m
    
50. 
    
51. # Put a capping on the size of the log files (in Kb).
    
52.    max log size = 50
    
53. 
    
54. # Security mode. Most people will want user level security. See
    
55. # security_level.txt for details.
    
56.    security = user
    
57. # Use password server option only with security = server
    
58. ;   password server = <NT-Server-Name>;
    
59. 
    
60. # Password Level allows matching of _n_ characters of the password for
    
61. # all combinations of upper and lower case.
    
62. ;  password level = 8
    
63. ;  username level = 8
    
64. 
    
65. # You may wish to use password encryption. Please read
    
66. # ENCRYPTION.txt, Win95.txt and WinNT.txt in the Samba documentation.
    
67. # Do not enable this option unless you have read those documents
    
68.   encrypt passwords = yes
    
69.   smb passwd file = /usr/local/samba/private/smbpasswd
    
70. 
    
71. # The following are needed to allow password changing from Windows to
    
72. # update the Linux system password also.
    
73. # NOTE: Use these with 'encrypt passwords' and 'smb passwd file' above.
    
74. # NOTE2: You do NOT need these to allow workstations to change only
    
75. #        the encrypted SMB passwords. They allow the Unix password
    
76. #        to be kept in sync with the SMB password.
    
77.   unix password sync = Yes
    
78.   passwd program = /usr/bin/passwd %u
    
79.   passwd chat = *New* %n\n *ReType* %n\n
    
80. 
    
81. # Unix users can map to different SMB User names
    
82.   username map = /usr/local/samba/private/smbusers
    
83. 
    
84. # Using the following line enables you to customise your configuration
    
85. # on a per machine basis. The %m gets replaced with the netbios name
    
86. # of the machine that is connecting
    
87. ;   include = /etc/samba/smb.conf.%m
    
88. 
    
89. # Most people will find that this option gives better performance.
    
90. # See speed.txt and the manual pages for details
    
91.    socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
    
92. 
    
93. # Configure Samba to use multiple interfaces
    
94. # If you have multiple network interfaces then you must list them
    
95. # here. See the man page for details.
    
96. ;   interfaces = 192.168.12.2/24 192.168.13.2/24
    
97. 
    
98. # Configure remote browse list synchronisation here
    
99. #  request announcement to, or browse list sync from:
    
100. #       a specific host or from / to a whole subnet (see below)
     
101. ;   remote browse sync = 192.168.3.25 192.168.5.255
     
102. # Cause this host to announce itself to local subnets here
     
103. ;   remote announce = 192.168.1.255 192.168.2.44
     
104. 
     
105. # Browser Control Options:
     
106. # set local master to no if you don't want Samba to become a master
     
107. # browser on your network. Otherwise the normal election rules apply
     
108.   local master = yes
     
109. 
     
110. # OS Level determines the precedence of this server in master browser
     
111. # elections. The default value should be reasonable
     
112.    os level = 64
     
113. 
     
114. # Domain Master specifies Samba to be the Domain Master Browser. This
     
115. # allows Samba to collate browse lists between subnets. Don't use this
     
116. # if you already have a Windows NT domain controller doing this job
     
117.    domain master = yes
     
118. 
     
119. # Preferred Master causes Samba to force a local browser election on startup
     
120. # and gives it a slightly higher chance of winning the election
     
121.    preferred master = yes
     
122. 
     
123. # Enable this if you want Samba to be a domain logon server for
     
124. # Windows95 workstations.
     
125.    domain logons = yes
     
126. 
     
127. # if you enable domain logons then you may want a per-machine or
     
128. # per user logon script
     
129. # run a specific logon batch file per workstation (machine)
     
130. ;   logon script = %m.bat
     
131. # run a specific logon batch file per username
     
132. ;   logon script = %U.bat
     
133.     logon script = icil.bat
     
134. # Where to store roving profiles (only for Win95 and WinNT)
     
135. #        %L substitutes for this servers netbios name, %U is username
     
136. #        You must uncomment the [Profiles] share below
     
137. 
     
138.   logon drive = Z:
     
139. 
     
140.   logon home = \\%N\%U
     
141. 
     
142.   logon path = \\%N\%U\profile
     
143. 
     
144. 
     
145. 
     
146. # All NetBIOS names must be resolved to IP Addresses
     
147. # 'Name Resolve Order' allows the named resolution mechanism to be specified
     
148. # the default order is "host lmhosts wins bcast". "host" means use the unix
     
149. # system gethostbyname() function call that will use either /etc/hosts OR
     
150. # DNS or NIS depending on the settings of /etc/host.config, /etc/nsswitch.conf
     
151. # and the /etc/resolv.conf file. "host" therefore is system configuration
     
152. # dependant. This parameter is most often of use to prevent DNS lookups
     
153. # in order to resolve NetBIOS names to IP Addresses. Use with care!
     
154. # The example below excludes use of name resolution for machines that are NOT
     
155. # on the local network segment
     
156. # - OR - are not deliberately to be known via lmhosts or via WINS.
     
157. name resolve order = wins lmhosts bcast
     
158. 
     
159. # Windows Internet Name Serving Support Section:
     
160. # WINS Support - Tells the NMBD component of Samba to enable it's WINS Server
     
161.    wins support = yes
     
162. 
     
163. # WINS Server - Tells the NMBD components of Samba to be a WINS Client
     
164. #       Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
     
165. ;   wins server = w.x.y.z
     
166. 
     
167. # WINS Proxy - Tells Samba to answer name resolution queries on
     
168. # behalf of a non WINS capable client, for this to work there must be
     
169. # at least one  WINS Server on the network. The default is NO.
     
170. ;   wins proxy = yes
     
171. 
     
172. # DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
     
173. # via DNS nslookups. The built-in default for versions 1.9.17 is yes,
     
174. # this has been changed in version 1.9.18 to no.
     
175.    dns proxy = no
     
176. 
     
177. # Case Preservation can be handy - system default is _no_
     
178. # NOTE: These can be set on a per share basis
     
179. ;  preserve case = no
     
180. ;  short preserve case = no
     
181. # Default case is normally upper case for all DOS files
     
182. ;  default case = lower
     
183. # Be very careful with case sensitivity - it can break things!
     
184. ;  case sensitive = no
     
185. 
     
186. #============================ Share Definitions ==============================
     
187. [homes]
     
188.    comment = Home Directories
     
189. 
     
190.     browseable = no
     
191.     writeable = yes
     
192. 
     
193. # Un-comment the following and create the netlogon directory for Domain Logons
     
194. [netlogon]
     
195.    comment = Network Logon Service
     
196.    path = /icil/home/netlogon
     
197.    guest ok = yes
     
198.    writable = no
     
199.    share modes = no
     
200. 
     
201. 
     
202. # Un-comment the following to provide a specific roving profile share
     
203. # the default is to use the user's home directory
     
204. ;[profiles]
     
205. ;    path = /icil/home/profiles
     
206. ;    browseable = yes
     
207. ;    guest ok = yes
     
208. ;    create mask = 0600
     
209. ;    directory mask = 0700
     
210. 
     
211. [DEPT]
     
212.    comment =  Dept folder
     
213.    path = /icil/dept
     
214.    guest ok = yes
     
215.    writeable = yes
     
216.    create mode = 0666
     
217. 
     
218. [GHOST]
     
219.    comment =  Ghost image folder
     
220.    path = /ghost
     
221.    guest ok = yes
     
222.    writeable = yes
     
223.    create mode = 0666
     

复制代码

Samba其他功能

1， Smbclient使用PC共享资源
smbclient '\\'${host}'\C$' -Uuser%"password" –W domain
操作方式类似FTP。具体操作方式略。

2，smbprint使用共享打印机（略）

Samba FAQ(略)
请查阅samba.org或Google以解决问题。

请参考以下站点来解决更深层次的问题：
http://www.samba.org[/code]