{{tag>fr fr:linux fr:serveur fr:transfert_de_fichier}}
====== Serveur de fichiers (SAMBA) ======
Cette page décrit l'installation et la configuration du serveur de fichier Samba.
===== Installation =====
Pour mettre en place un serveur samba, il suffit d'ajouter le package :
* samba
Il est aussi conseillé d'installer les packages clients :
* smbfs
* smbclient
Pour plus d'information sur la configuration client, voir [[linux:config:Mount]].
Lors de l'installation de samba, il faut définir :
* le groupe de travail : Workgroup est le groupe par défaut de windows
* si les paramètres DHCP du serveur sont à prendre en compte : non par défaut
Une fois l'installation démarre avec quelques partages par défaut, en particulier le partage de la home utilisateur.
===== Configuration de la base utilisateur =====
Samba ne peut pas utiliser les mots de passe Unix, il faut donc créer attribuer à nouveau un mot de passe pour que l'utilisateur puisse se connecter.
A noter qu'il existe des mécanismes de synchronisation de mot de passe : les deux mots de passe unix/samba sont alors modifiés simultanéments (mais stockés dans des formats différents).
Dans samba 3, Debian utilise une base tdbsam située dans /var/lib/samba/passdb. Cette base n'est plus lisible avec vi.
Pour l'éditer, utiliser la commande "pdbedit" :
bender:~# pdbedit -L -v matthieu
Unix username: matthieu
NT username:
Account Flags: [U ]
User SID: S-1-5-21-590520919-606480194-2258220891-3000
Primary Group SID: S-1-5-21-590520919-606480194-2258220891-513
Full Name: matthieu,,,
Home Directory: \\bender\matthieu
HomeDir Drive:
Logon Script:
Profile Path: \\bender\matthieu\profile
Domain: BENDER
Account desc:
Workstations:
Munged dial:
Logon time: 0
Logoff time: dim, 07 fév 2106 07:28:15 CET
Kickoff time: dim, 07 fév 2106 07:28:15 CET
Password last set: 0
Password can change: 0
Password must change: dim, 07 fév 2106 07:28:15 CET
Last bad password : 0
Bad password count : 0
Logon hours : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
bender:~#
Pour modifier un mot de passe, il faut utiliser la commande "smbpasswd" :
bender:~# smbpasswd matthieu
New SMB password:
Retype new SMB password:
bender:~#
bender:~# pdbedit -L -v matthieu
Unix username: matthieu
NT username:
Account Flags: [U ]
User SID: S-1-5-21-590520919-606480194-2258220891-3000
Primary Group SID: S-1-5-21-590520919-606480194-2258220891-513
Full Name: matthieu,,,
Home Directory: \\bender\matthieu
HomeDir Drive:
Logon Script:
Profile Path: \\bender\matthieu\profile
Domain: BENDER
Account desc:
Workstations:
Munged dial:
Logon time: 0
Logoff time: dim, 07 fév 2106 07:28:15 CET
Kickoff time: dim, 07 fév 2106 07:28:15 CET
Password last set: jeu, 02 aoû 2007 21:15:06 CEST
Password can change: jeu, 02 aoû 2007 21:15:06 CEST
Password must change: dim, 07 fév 2106 07:28:15 CET
Last bad password : 0
Bad password count : 0
Logon hours : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
bender:~#
Un fois le mot de passe enregistré, il est possible de se connecter sur son partage utilisateur.
===== Configuration globale =====
La configuration de samba se trouve dans le fichier ///etc/samba/smb.conf//.
Voici maintenant quelques paramètres que j'utilise.
==== Définition du nom et domaine ====
Définition du domaine :
workgroup = Workgroup
Définition du nom netbios :
netbios name = Bender
==== Définition du fichier de log ====
Par défaut samba utilise un log par utilisateur, voici comment utiliser un seul fichier :
log file = /var/log/samba/log
==== Support des accents ====
Comme indiqué dans [[linux:config:linux_francais]], 2 méthodes d'encodages sont principalements utilisées dans l'informatique, l'ISO et l'UTF8. Windows utilise encore majoritairement ISO. Par défaut, Debian est en UTF8 et samba est facilement configurable en UTF8 ; cependant, seul le nommage des fichiers est affecté, le contenu est souvent codé par windows en ISO et peut poser problème pour le lire/modifier sous Linux. C'est pourquoi j'ai configuré mon serveur en ISO ainsi que Samba.
ISO-8859 : Pour supporter les accents français à travers le réseau, il est important de configurer samba comme un windows standard en ajoutant les paramètres suivants dans la partie [global] :
dos charset = 850
unix charset = ISO-8859-15
unix extensions = no
display charset = ISO-8859-15
==== Définition de la politique de sécurité ====
Par défaut samba est configuré en mode "user". Cela signifie qu'il faut disposer d'un user/pass valide pour accéder à l'ensemble des données.
Si vous souhaitez fournir des partages "public" disponibles sans user/pass, il est obligartoire de réaliser une sécurité de type "share".\\
Voir ///usr/share/doc/samba-doc/htmldocs/Samba-HOWTO-Collection/ServerType.html// pour plus d'informations.
security = share
De plus, il est possible de définir l'utilisateur utilisé lorsqu'un guest se connecte :
guest account = nobody
===== Définition des partages =====
Chaque partage est définit avec un ensemble de paramêtres personnalisés.
Les paramêtres courants sont :
* path : répertoire partagé.
* comment : libélé du répertoire.
* browsable = yes/no : indique si le répertoire est listé dans les répertoires disponibles.
* public = yes/no (équivalent de guest ok) : indique si il est possible de se connecter au partage en temps qu'invité.
* read only = yes/no : permet de forcer la lecture seule
* writable = yes/no : indique si le partage est modifiable
* valid users = utilisateur : indique une liste d'utilisateurs autorisés à accéder au partage
* force group : force le groupe de l'utilisateur
* create mask : définit les droits unix des nouveaux fichiers
* 0700 : rwx --- --- (par défaut)
* 0600 : rw- --- ---
* 0640 : rw- r-- --- (conseillé)
* 0644 : rw- r-- r--
* 0660 : rw- rw- ---
* 0664 : rw- rw- r--
* directory mask : définit les droits unix des nouveaux répertoires
* 0700 : rwx --- --- (par défaut)
* 0750 : rwx r-x --- (conseillé)
* 0755 : rwx r-x r-x
* preexec : définit une commande avant accès (par exemple monter un cdrom)
* postexec : définit une commande après accès
==== Exemple 1 : accès à un partage publique ====
[ftp]
path = /ftp
comment = FTP data
browseable = yes
read only = yes
public = yes
force group = ftp
==== Exemple 2 : accès restreint ====
[incoming]
valid users = matthieu
path = /space2
comment = A trier
browseable = no
writable = yes
[backup]
valid users = matthieu
path = /backup
comment = Archivé
browseable = no
read only = yes
==== Exemple 3 : partage des homes ====
[homes]
comment = Home Directories
browseable = no
# By default, the home directories are exported read-only. Change next
# parameter to 'yes' if you want to be able to write to them.
; writable = no
writable = yes
# File creation mask is set to 0700 for security reasons. If you want to
# create files with group=rw permissions, set next parameter to 0775.
; create mask = 0700
create mask = 0640
# Directory creation mask is set to 0700 for security reasons. If you want to
# create dirs. with group=rw permissions, set next parameter to 0775.
directory mask = 0750
# Restrict access to home directories
# to the one of the authenticated user
# This might need tweaking when using external authentication schemes
valid users = %S
==== Exemple 4 : partage cdrom ====
# A sample share for sharing your CD-ROM with others.
[cdrom]
path = /media/cdrom
comment = CDROM de %L
writable = no
# locking = no
public = yes
# The next two parameters show how to auto-mount a CD-ROM when the
# cdrom share is accesed. For this to work /etc/fstab must contain
# an entry like this:
#
# /dev/scd0 /cdrom iso9660 defaults,noauto,ro,user 0 0
#
# The CD-ROM gets unmounted automatically after the connection to the
#
# If you don't want to use auto-mounting/unmounting make sure the CD
# is mounted on /cdrom
#
#Commande de montage automatique en cas d'accès
preexec = /bin/mount /media/cdrom
postexec = /bin/umount /media/cdrom
==== Exemple 5 : partage disquette ====
[floppy]
path = /media/floppy
comment = Disquette de %L
writable = no
public = yes
preexec = /bin/mount /media/floppy
postexec = /bin/umount /media/floppy
===== Exemple complet =====
///etc/samba/smb.conf// :
#
# Sample configuration file for the Samba suite for Debian GNU/Linux.
#
#
# This is the main Samba configuration file. You should read the
# smb.conf(5) manual page in order to understand the options listed
# here. Samba has a huge number of configurable options most of which
# are not shown in this example
#
# Any line which starts with a ; (semi-colon) or a # (hash)
# is a comment and is ignored. In this example we will use a #
# for commentary and a ; for parts of the config file that you
# may wish to enable
#
# NOTE: Whenever you modify this file you should run the command
# "testparm" to check that you have not many any basic syntactic
# errors.
#
#======================= Global Settings =======================
[global]
## Browsing/Identification ###
# Change this to the workgroup/NT-domain name your Samba server will part of
workgroup = Workgroup
netbios name = Gandalf
# server string is the equivalent of the NT Description field
server string = %h server (Samba %v)
# Windows Internet Name Serving Support Section:
# WINS Support - Tells the NMBD component of Samba to enable its WINS Server
; wins support = no
# WINS Server - Tells the NMBD components of Samba to be a WINS Client
# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
; wins server = w.x.y.z
# This will prevent nmbd to search for NetBIOS names through DNS.
dns proxy = no
# What naming service and in what order should we use to resolve host names
# to IP addresses
; name resolve order = lmhosts host wins bcast
#### Debugging/Accounting ####
# This tells Samba to use a separate log file for each machine
# that connects
# log file = /var/log/samba/log.%m
log file = /var/log/samba/log
# Put a capping on the size of the log files (in Kb).
max log size = 1000
# If you want Samba to only log through syslog then set the following
# parameter to 'yes'.
; syslog only = no
# We want Samba to log a minimum amount of information to syslog. Everything
# should go to /var/log/samba/log.{smbd,nmbd} instead. If you want to log
# through syslog you should set the following parameter to something higher.
syslog = 0
# Do something sensible when Samba crashes: mail the admin a backtrace
panic action = /usr/share/samba/panic-action %d
####### Authentication #######
# "security = user" is always a good idea. This will require a Unix account
# in this server for every user accessing the server. See
# /usr/share/doc/samba-doc/htmldocs/Samba-HOWTO-Collection/ServerType.html
# in the samba-doc package for details.
; security = user
security = share
# You may wish to use password encryption. See the section on
# 'encrypt passwords' in the smb.conf(5) manpage before enabling.
encrypt passwords = true
# If you are using encrypted passwords, Samba will need to know what
# password database type you are using.
passdb backend = tdbsam
obey pam restrictions = yes
guest account = nobody
invalid users = root
# This boolean parameter controls whether Samba attempts to sync the Unix
# password with the SMB password when the encrypted SMB password in the
# passdb is changed.
; unix password sync = no
# For Unix password sync to work on a Debian GNU/Linux system, the following
# parameters must be set (thanks to Augustin Luton for
# sending the correct chat script for the passwd program in Debian Potato).
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n .
# This boolean controls whether PAM will be used for password changes
# when requested by an SMB client instead of the program listed in
# 'passwd program'. The default is 'no'.
; pam password change = no
########## Printing ##########
# If you want to automatically load your printer list rather
# than setting them up individually then you'll need this
; load printers = yes
# lpr(ng) printing. You may wish to override the location of the
# printcap file
; printing = bsd
; printcap name = /etc/printcap
# CUPS printing. See also the cupsaddsmb(8) manpage in the
# cupsys-client package.
; printing = cups
; printcap name = cups
# When using [print$], root is implicitly a 'printer admin', but you can
# also give this right to other users to add drivers and set printer
# properties
; printer admin = @ntadmin
######## File sharing ########
# Name mangling options
; preserve case = yes
; short preserve case = yes
#Pour utiliser les charactères accentués
dos charset = 850
unix charset = ISO-8859-1
unix extensions = no
display charset = ISO-8859-1
############ Misc ############
# Using the following line enables you to customise your configuration
# on a per machine basis. The %m gets replaced with the netbios name
# of the machine that is connecting
; include = /home/samba/etc/smb.conf.%m
# Most people will find that this option gives better performance.
# See smb.conf(5) and /usr/share/doc/samba-doc/htmldocs/speed.html
# for details
# You may want to add the following on a Linux system:
# SO_RCVBUF=8192 SO_SNDBUF=8192
socket options = TCP_NODELAY
# The following parameter is useful only if you have the linpopup package
# installed. The samba maintainer and the linpopup maintainer are
# working to ease installation and configuration of linpopup and samba.
; message command = /bin/sh -c '/usr/bin/linpopup "%f" "%m" %s; rm %s' &
# Domain Master specifies Samba to be the Domain Master Browser. If this
# machine will be configured as a BDC (a secondary logon server), you
# must set this to 'no'; otherwise, the default behavior is recommended.
domain master = auto
# Some defaults for winbind (make sure you're not using the ranges
# for something else.)
; idmap uid = 10000-20000
; idmap gid = 10000-20000
; template shell = /bin/bash
#======================= Share Definitions =======================
[ftp]
path = /ftp
comment = FTP data
browseable = yes
read only = yes
public = yes
force group = ftp
[incoming]
path = /space2
comment = A trier
browseable = no
writable = yes
[backup]
path = /backup
comment = Archivé
browseable = no
read only = yes
[homes]
comment = Home Directories
browseable = no
# By default, the home directories are exported read-only. Change next
# parameter to 'yes' if you want to be able to write to them.
writable = yes
# File creation mask is set to 0700 for security reasons. If you want to
# create files with group=rw permissions, set next parameter to 0775.
create mask = 0600
# Directory creation mask is set to 0700 for security reasons. If you want to
# create dirs. with group=rw permissions, set next parameter to 0775.
directory mask = 0700
# Un-comment the following and create the netlogon directory for Domain Logons
# (you need to configure Samba to act as a domain controller too.)
;[netlogon]
; comment = Network Logon Service
; path = /home/samba/netlogon
; guest ok = yes
; writable = no
; share modes = no
;[printers]
; comment = All Printers
; browseable = no
; path = /tmp
; printable = yes
; public = no
; writable = no
; create mode = 0700
# Windows clients look for this share name as a source of downloadable
# printer drivers
;[print$]
; comment = Printer Drivers
; path = /var/lib/samba/printers
; browseable = yes
; read only = yes
; guest ok = no
# Uncomment to allow remote administration of Windows print drivers.
# Replace 'ntadmin' with the name of the group your admin users are
# members of.
; write list = root, @ntadmin
# A sample share for sharing your CD-ROM with others.
[cdrom]
path = /media/cdrom
comment = CDROM de %L
writable = no
# locking = no
public = yes
# The next two parameters show how to auto-mount a CD-ROM when the
# cdrom share is accesed. For this to work /etc/fstab must contain
# an entry like this:
#
# /dev/scd0 /cdrom iso9660 defaults,noauto,ro,user 0 0
#
# The CD-ROM gets unmounted automatically after the connection to the
#
# If you don't want to use auto-mounting/unmounting make sure the CD
# is mounted on /cdrom
#
#Commande de montage automatique en cas d'accès
preexec = /bin/mount /media/cdrom
postexec = /bin/umount /media/cdrom
[floppy]
path = /media/floppy
comment = Disquette de %L
writable = no
public = yes
preexec = /bin/mount /media/floppy
postexec = /bin/umount /media/floppy
===== Backup =====
* /etc/samba/smb.conf
* /var/lib/samba/passdb.tdb
===== Links =====
* http://www.samba.org/