☰

如何更改 Samba 子文件夹的权限？

tag-icon • tag-icon linux permissions acl shared-folders samba4
如何更改 Samba 子文件夹的权限？

我有一个 Samba 服务器，Active Directory 中有 ROLE_DOMAIN_MEMBER。我的主要目标是对每个共享的共享子文件夹设置不同的权限。可以使用 Linux acl 或 Windows 权限 GUI 来完成，但我更喜欢 Windows GUI。在这种情况下，用户可以自行执行此操作。

我已经尝试使用 chmod、chown、acl、Windows GUI 和 Windows 控制台 GUI 更改权限，并且我可以更改子文件夹的权限，但似乎它不起作用，只有添加到 samba-share 的组对我有用，也适用于子文件夹

valid users = "+DOMAIN.LOCAL\IT" # "+DOMAIN.LOCAL\adm" # "+DOMAIN.LOCAL\DR" # "DOMAIN.LOCAL\PRINTERS"
admin users = "+DOMAIN.LOCAL\IT" # "+DOMAIN.LOCAL\adm" # "+DOMAIN.LOCAL\DR" # "DOMAIN.LOCAL\PRINTERS"

我在这里打印我所有的 smb.cfg 和一个测试共享：

[global]
# No .tld
workgroup = DOMAIN
netbios name = samba4
server string = %h server (Samba, Ubuntu)
# Active Directory System
security = ads
# With .tld
realm = DOMAIN.LOCAL
# Just a member server
domain master = no
local master = no
preferred master = no
dns proxy = no
# Disable printing error log messages when CUPS is not installed.
printcap name = /dev/null
load printers = no
printcap cache time = 0
#additional section
obey pam restrictions = yes
map to guest = bad user
dns proxy = no
vfs objects = acl_xattr
map acl inherit = yes
nt acl support = yes
acl map full control = yes
#acl compatibility = auto
store dos attributes = yes
map archive = no
map hidden = no
map read only = no
map system = no
# Works both in samba 3.2 and 3.6.
#idmap backend = tdb
# no .tld
idmap config * : backend = tdb
idmap config * : range = 10000-99999
winbind enum users = yes
winbind enum groups = yes
# This way users log in with username instead of [email protected]
winbind use default domain = yes
# Inherit groups in groups
winbind nested groups = yes
winbind refresh tickets = yes
winbind offline logon = true
#winbind separator = \
# Becomes /home/example/username
template homedir = /home/%D/%U
#logon drive = H:
#logon home = \\smb\%U
# No shell access
template shell = /bin/bash
client use spnego = yes
client ntlmv2 auth = yes
#password server = dc01.domain.local, dc02.domain.local
password server = *
encrypt passwords = yes
unix password sync = yes
pam password change = yes
smb passwd file = /etc/samba/smbpasswd
os level = 20
restrict anonymous = 2
log file = /var/log/samba/samba.log
log level = 3
#logging = syslog@1 /var/log/samba/log.%m
vfs objects = full_audit
full_audit:success = mkdir rmdir unlink pwrite
full_audit:prefix = %u|%I|%m|%S
full_audit:failure = none
full_audit:facility = local5
full_audit:priority = notice
recycle:repository = /home/recycle/
recycle:keeptree = yes
recycle:versions = yes
max log size = 100000
panic action = /usr/share/samba/panic-action %d
guest ok = yes

[test$]
        path = /FS/test$
        browseable = yes
        read only = no
        inherit acls = yes
        inherit permissions = yes
        create mask = 700
        directory mask = 700
        valid users = "+DOMAIN.LOCAL\IT" # "+DOMAIN.LOCAL\adm" # "+DOMAIN.LOCAL\DR" # "DOMAIN.LOCAL\PRINTERS"
        admin users = "+DOMAIN.LOCAL\IT" # "+DOMAIN.LOCAL\adm" # "+DOMAIN.LOCAL\DR" # "DOMAIN.LOCAL\PRINTERS"

┌─[root@samba4]─[/FS]
└──╼ #ls -ld test\$/
drwxrwx---+ 6 root root 4096 Jun 25 15:44 test$/

访问控制列表配置：

cat /boot/config-4.4.0-87-generic  | grep _ACL
CONFIG_EXT4_FS_POSIX_ACL=y
CONFIG_REISERFS_FS_POSIX_ACL=y
CONFIG_JFS_POSIX_ACL=y
CONFIG_XFS_POSIX_ACL=y
CONFIG_BTRFS_FS_POSIX_ACL=y
CONFIG_F2FS_FS_POSIX_ACL=y
CONFIG_FS_POSIX_ACL=y
CONFIG_TMPFS_POSIX_ACL=y
CONFIG_HFSPLUS_FS_POSIX_ACL=y
CONFIG_JFFS2_FS_POSIX_ACL=y
CONFIG_NFS_V3_ACL=y
CONFIG_NFSD_V2_ACL=y
CONFIG_NFSD_V3_ACL=y
CONFIG_NFS_ACL_SUPPORT=m
CONFIG_CEPH_FS_POSIX_ACL=y
CONFIG_CIFS_ACL=y
CONFIG_9P_FS_POSIX_ACL=y

我的文件系统表：

UUID=4ec48dfe-c45d-124b-8145-09fe59cfad9b /FS ext4 relatime,acl,user_xattr,errors=remount-ro 0 1

在 samba.log 中，当我尝试更改测试目录的权限时，我发现 acl 权限有问题。

set_nt_acl: failed to set file acl on file test (Operation not permitted).

另外，我将测试目录的权限更改为 777 并删除选项“创建掩码”、“目录掩码”、“管理用户”。现在我什至无法添加新用户的文件权限。

答案1

如果您想使用 Windows 权限，则需要删除覆盖它们的 UNIX/Linux 权限控制。

chmod 777 '/FS/test$'

从共享定义中删除这些行：

create mask = 700
directory mask = 700
admin users = ...

相关内容