☰

管理员用户无法在 Samba 3 上工作

tag-icon • tag-icon debian samba
管理员用户无法在 Samba 3 上工作

我正在 Debian Wheezy 上设置一个新的 Samba3 域。我安装了软件包，并根据自己的喜好调整了 smb.conf 文件。但是我无法访问共享，除了那些我应该访问的共享根据我自己的团体成员身份。这似乎很正常，但我也被admin users列为[global]节中也被列为。在我的所有其他 Samba3 站点中，我都可以使用该用户名访问每一个共享可用。我遗漏了什么？

我粘贴了大部分 smb.conf 文件，但我正尝试真正访问该supo文件夹。

/etc/samba/smb.conf 的输出：

[global]
        workgroup = workgroup
        server string = %h server
        map to guest = Bad User
        obey pam restrictions = Yes
        pam password change = Yes
        passwd program = /usr/bin/passwd %u
        passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
        unix password sync = Yes
        syslog = 0
        log file = /var/log/samba/log.%m
        max log size = 1000
        name resolve order = wins lmhosts host bcast
        add user script = /usr/sbin/adduser --quiet --disabled-password --gecos"" %u
        add group script = /usr/sbin/addgroup --force-badname %g
        add machine script = /usr/sbin/useradd -g machines -c "%u machine account" -d /var/lib/samba -s /bin/false %u
        logon drive = H:
        domain logons = Yes
        dns proxy = No
        wins support = Yes
        panic action = /usr/share/samba/panic-action %d
        idmap config * : backend = tdb
        valid users = @staff
        admin users = luke, @another_group

[homes]
        comment = Home Directories
        valid users = %S
        read only = No
        create mask = 0700
        directory mask = 0700
        browseable = No
# works - I am a user

[trgo]
        path = /home/trgo
        valid users = @trgo
        read only = No
        inherit permissions = Yes
# works - I'm in the trgo group

[supo]
        path = /home/supo
        valid users = @supo
        read only = No
        inherit permissions = Yes
# doesn't work - I'm not in the supo group

[public]
        path = /home/public
        read only = No
        inherit permissions = Yes
# works - I'm in the staff group

答案1

valid users您还可以在（同样）参数中设置多个组/用户，invalid users如下所示：

[supo]
        path = /home/supo
        valid users = @supo, @trgo
        read only = No
        inherit permissions = Yes
# works - you are joined to at least one of the group

如果您不信任该组中的某个人，您也可以使用invalid users：

[supo]
        path = /home/supo
        invalid users = canadian 
        valid users = @supo, @trgo
        read only = No
        inherit permissions = Yes
# doesn't work - you are not authorised, even if you are member of the trgo group ;)

手册没有指定应用规则的顺序，但该invalid users部分暗示它优先：

这是不允许登录此网站的用户列表
服务。这真是偏执检查绝对确保
不正确的设置并不会危害您的安全。

相关内容