☰

Samba - 创建具有自己权限的子目录共享

tag-icon • tag-icon linux permissions mount network-shares samba
Samba - 创建具有自己权限的子目录共享

我有一个 Samba 共享，其中包含许多如下文件夹：

share
  - folderA
  - folderB
  - folderC
  - folderD

大约有 20 个用户访问这些共享。每个用户都可以访问某些目录，例如 Ben 可以访问文件夹 A 和文件夹 C，但不能访问文件夹 B 和文件夹 D。Jenny 可以访问文件夹 B 和文件夹 C，等等。

我不希望用户挂载他们需要的每个文件夹。我希望他们挂载包含所有子文件夹的文件夹“共享”。然后通过设置 Linux 权限来限制访问。

我为每个子目录创建了一个组，并将用户添加到这些组中。访问控制对现有文件完美无缺。但每当用户在子目录中创建文件时，所有其他拥有该目录读/写访问权限的用户都会被拒绝。为了解决这个问题，我尝试了 samba 屏蔽，但无法让它工作。

我的 Samba 配置如下：

guest ok = no

[global]
workgroup = WORKGROUP
security  = user
encrypt passwords = yes

[Share]
path        = /var/samba
valid users = @everybody
read only   = no
writeable   = yes

[folderA]
path        = /var/samba/folderA
valid users = @users_folderA
read only   = no
writeable   = yes

create mask          = 770
directory mask       = 770
force directory mode = 770

force group = users_folderA

[folderB]
path        = /var/samba/folderB
valid users = @users_folderB
read only   = no
writeable   = yes

create mask          = 770
directory mask       = 770
force directory mode = 770

force group = users_folderB

[folderC]
path        = /var/samba/folderC
valid users = @users_folderC
read only   = no
writeable   = yes

create mask          = 770
directory mask       = 770
force directory mode = 770

force group = users_folderC

[folderD]
path        = /var/samba/folderD
valid users = @users_folderD
read only   = no
writeable   = yes

create mask          = 770
directory mask       = 770
force directory mode = 770

force group = users_folderD

因此显然每个用户都在 everyone 组中，因此他们可以挂载带有子目录的共享。每个子目录的访问都运行正常。但每当 Ben 在文件夹 C 中创建文件时，该文件都会获得文件权限 -rwxr--r-- 但它应该是 -rwxrwx---

我认为单个文件夹的共享根本不起作用，因为我尝试设置 writeable = no 和 read only = yes 来测试它。重新启动 smbd 和 nmbd 并重新安装网络共享（在 Windows 10 中）。用户可以创建文件并修改自己的文件。

它运行在装有 raspbian 的 raspberry pi 上。包含文件的硬盘格式为 ext4，并通过 fstab 安装。

答案1

尝试此配置（用于共享部分）：

[Share]
path        = /var/samba
valid users = @everybody
force group = +everybody
writeable   = yes
create mask = 0660
force create mode = 0110
directory mask = 0770

[folderA]
path        = /var/samba/folderA
valid users = @users_folderA
force group = +users_folderA
browseable = no

[folderB]
path        = /var/samba/folderB
valid users = @users_folderB
force group = +users_folderB
browseable = no

[folderC]
path        = /var/samba/folderC
valid users = @users_folderC
force group = +users_folderC
browseable = no

[folderD]
path        = /var/samba/folderD
valid users = @users_folderD
force group = +users_folderD
browseable = no

不要忘记检查配置并重新启动 samba：

# testparm
# service smbd restart
# service nmbd restart

设置权限：

chown root:everybody /var/samba
chmod 770 /var/samba
chown root:users_folderA /var/samba/folderA
chmod 2770 /var/samba/folderA
chown root:users_folderB /var/samba/folderB
chmod 2770 /var/samba/folderB
chown root:users_folderC /var/samba/folderC
chmod 2770 /var/samba/folderC
chown root:users_folderD /var/samba/folderD
chmod 2770 /var/samba/folderD

这样就不允许直接访问内部文件夹。而且，它们根本不可见，只能通过父文件夹访问。

相关内容