☰

Samba 服务器 - CIFS 挂载问题

tag-icon • tag-icon samba
Samba 服务器 - CIFS 挂载问题

背景：

我有一台 samba cifs 服务器。它未加入域，但有一个 MIT kerberosV 领域的密钥表。

Kerberized 挂载（例如mount -t cifs //cifs.example.com/groups /mnt/cifs -o sec=krb5i）适用于 Linux 客户端。Kerberized 挂载适用于已加入 AD 的 Windows 计算机（已加入配置了对 Kerberos Realm 的信任的域）。基于密码的挂载不适用于 Linux 客户端（没什么大不了的）。

针对未加入 AD 的 Windows 客户端的基于密码的安装有点儿可以工作。使用资源管理器转到\\cifs.example.com\groups将不起作用，并且不会出现密码提示。但是，如果\\cifs.example.com\groups作为字母驱动器安装，则对话框将无法完成，但驱动器映射将建立并工作，此时可以取消对话框，同时保留安装。

问题：

  1. 如何让 UNC 路径在未加入 AD 的 Windows 计算机上提示输入密码？

配置：

主机名：cifs.example.com 领域：EXAMPLE.COM 发行版：CentOS 版本 6.5（最终版）
Samba 版本：samba-3.6.9-167.el6_5.x86_64

smb配置文件

syslog only = yes
syslog = 3

server string = %h server (Samba, CentOS)
workgroup = EXAMPLE.COM
security = ads
realm = EXAMPLE.COM
create krb5 conf = no
kerberos method = secrets and keytab
server signing = auto
smb encrypt = auto
smb ports = 445
use sendfile = yes

map to guest = Bad User
guest account = nobody

wins support = no
dns proxy = no

load printers = no
printing = bsd
printcap name = /dev/null
disable spoolss = yes

hide files = /Desktop.ini/$RECYCLE.BIN/Thumbs.db/~$.*/

[home]
path = /export/home/
writeable = yes
guest ok = no
browseable = no
create mask = 0600
directory mask = 0700

[groups]
path = /export/groups
writeable = yes
guest ok = no
browseable = yes
create mask = 0660
directory mask = 0770

*

列表-k

Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   8 host/[email protected]
   8 host/[email protected]
   8 host/[email protected]
   8 host/[email protected]
   8 cifs/[email protected]
   8 cifs/[email protected]
   8 cifs/[email protected]
   8 cifs/[email protected]

getsebool -a | grep -e cifs -e samba

allow_ftpd_use_cifs --> off
cobbler_use_cifs --> off
git_cgi_use_cifs --> off
git_system_use_cifs --> off
httpd_use_cifs --> off
qemu_use_cifs --> on
rsync_use_cifs --> off
samba_create_home_dirs --> off
samba_domain_controller --> off
samba_enable_home_dirs --> off
samba_export_all_ro --> off
samba_export_all_rw --> off
samba_portmapper --> off
samba_run_unconfined --> off
samba_share_fusefs --> off
samba_share_nfs --> off
sanlock_use_samba --> off
tftp_use_cifs --> off
use_samba_home_dirs --> off
virt_use_samba --> off

桑巴舞

#%PAM-1.0
auth       required pam_nologin.so
auth       include  password-auth
account    include  password-auth
session    include  password-auth
password   include  password-auth

/etc/pam.d/密码验证

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_sss.so use_first_pass
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_sss.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_sss.so

答案1

需要max protocol从默认协议更改NT1为最大协议 =SMB2。

相关内容