#Samba实验内容
#权限不算太复杂，可以使用samba的权限管控，或者使用acl设置权限。复杂的就是用acl设置吧。
#系统版本：Centos 7
samba版本：4.7.1
#安装软件包：
samba-common
samba-client
samba
samba-libs

#权限分配示例图

#权限设计

[[homes]all
[public]xzb:rwxother:r-x
[财务报表]zjb:r-xcwb:rwx
[工资表]zjb:r--cwb:rwxxzb:rwx
[设计原型]yf:r-xsj:rwx
[开发文档]yf:rwx
[客服文档]zjb:r-xkf:rwx
[录音]zjb:r-xkf:rwx
[市场推广]zjb:r-xscb:r-xsczj:rwx

#用户

总经办：zjb
财务部：cwb
行政部：xzb
设计：sj
研发：yf
运维：yw
客服：kf
市场部：scb
市场总监：sczj

#目录

财务报表：cwbb
工资表：gzb
设计原型：sjyx
开发文档：kfwd
客服文档：wd
录音：ly
市场推广：sctg

#创建系统用户

sudo useradd -g samba -s /sbin/nologin zjb
sudo useradd -g samba -s /sbin/nologin cwb
sudo useradd -g samba -s /sbin/nologin xzb
sudo useradd -g samba -s /sbin/nologin sj
sudo useradd -g samba -s /sbin/nologin yf
sudo useradd -g samba -s /sbin/nologin yw
sudo useradd -g samba -s /sbin/nologin kf
sudo useradd -g samba -s /sbin/nologin scb
sudo useradd -g samba -s /sbin/nologin sczj

#创建samba用户

pdbedit -a -u zjb
pdbedit -a -u cwb
pdbedit -a -u xzb
pdbedit -a -u sj
pdbedit -a -u yf
pdbedit -a -u yw
pdbedit -a -u kf
pdbedit -a -u scb
pdbedit -a -u sczj

#新建目录
mkdir -p /data/share;cd /data/share

mkdir cwbb gzb sjyx kfwd wd ly sctg

#修改权限
chown -R samba.samba cwbb gzb sjyx kfwd wd ly sctg

chmod 700 cwbb gzb sjyx kfwd wd ly sctg

chmod 750 public

#配置文档
vim /etc/samba/smb.conf

[global]workgroup = Sambaserver string = Samba servermax log size = 50log file = /var/log/samba/log.%msecurity = userpassdb backend = tdbsamusername map = /etc/samba/smbusers[homes]comment = Home Dirctoriesvalid users = %S, %D%w%Sbrowseable = Noread only = Noinherit acls = Yes[public]comment = public sharepath = /data/share/publicguest ok = yesbrowseable = yeswrite list = xzb[财务报表]comment = cwbbpath = /data/share/cwbbbrowseable = yeswritable = yes[工资表]comment = gzbpath = /data/share/gzbbrowseable = yeswritable = yes[设计原型]comment = sjyxpath = /data/share/sjyxbrowseable = yeswritable = yes[开发文档]comment = kfwdpath = /data/share/kfwdbrowseable = yeswritable = yes[客服文档]comment = wdpath = /data/share/wdbrowseable = yeswritable = yes[录音]comment = lypath = /data/share/lybrowseable = yeswritable = yes[市场推广]comment = sctgpath = /data/share/sctgbrowseable = yeswritable = yes

#测试配置是否有问题，通过。。ok
[root@elk-master share]# testparm

Load smb config files from /etc/samba/smb.conf
Processing section "[homes]"
Processing section "[public]"
Processing section "[财务报表]"
Processing section "[工资表]"
Processing section "[设计原型]"
Processing section "[开发文档]"
Processing section "[客服文档]"
Processing section "[录音]"
Processing section "[市场推广]"
Loaded services file OK.
Server role: ROLE_STANDALONE
下面省略。。

#重启
systemctl restart nmb
systemctl restart smb

#使用acl设置权限

setfacl -m u:zxb:rwx /data/share/public
setfacl -m u:cwb:rws /data/share/cwbb
setfacl -m u:zjb:r-x /data/share/cwbb
setfacl -m u:zjb:r-x /data/share/gzb
setfacl -m u:cwb:r-x /data/share/gzb
setfacl -m u:zxb:rwx /data/share/gzb
setfacl -m u:yf:r-x /data/share/sjyx
setfacl -m u:sj:rwx /data/share/sjyx
setfacl -m u:yf:rwx /data/share/kfwd
setfacl -m u:kf:rwx /data/share/wd
setfacl -m u:zjb:r-x /data/share/wd
setfacl -m u:kf:rwx /data/share/ly
setfacl -m u:zjb:r-x /data/share/ly
setfacl -m u:sczj:rwx /data/share/sctg
setfacl -m u:zjb:r-x /data/share/sctg
setfacl -m u:scb:r-x /data/share/sctg

→→完成,自己折腾下自己，做个笔记，用户多就需要写脚本了。