目前我的 samba 服务器与 Windows Active Directory 2012 集成,几乎配置都很好。我只是好奇这是我的 smb.conf,
[global]
workgroup = "Domain Name"
server string = Samba Server Version %v
security = ads
realm = "Domain Name".NET
domain master = no
local master = no
preferred master = no
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
idmap config * : backend = tdb
idmap config * : range = 100000-299999
idmap config TEST : backend = rid
idmap config TEST : range = 10000-99999
winbind separator = +
winbind enum users = yes
winbind enum groups = yes
winbind use default domain = yes
winbind nested groups = yes
winbind refresh tickets = yes
template homedir = /home/%D/%U
template shell = /bin/bash
client use spnego = yes
client ntlmv2 auth = yes
encrypt passwords = yes
restrict anonymous = 2
log file = /var/log/samba/log.%m
max log size = 50
[datashare]
comment = data share
path = /data/datashare
read only = no
valid users = @"Domain Name+internal"
force group = internal
valid group = internal
directory mode = 0770
force directory mode = 0770
create mode = 0770
force create mode = 0770
# Hide share from users who don't have access
access based share enum = yes
# Hide files/directories if user doesn't have read access
hide unreadable = yes
browseable = no
include = /etc/samba/conf.d/conf.datashare%m #new config
/etc/samba/conf.d/conf.datashare 的内容
browseable = yes
參考文獻:http://www.samba.org/samba/docs/using_samba/ch06.html
使用当前配置,对于所有用户和组来说,根文件夹 samba 中几乎所有文件夹都无法隐藏。在我添加行 #new config 后,datashare 文件夹对于所有用户和组都是隐藏的(不可浏览)。
我的问题是,如何显示根 samba 文件夹中特定组的文件夹?
答案1
没有办法实现你正在尝试的目标。如果你删除:
force group = internal
然后用户将使用其 AD 组的组权限进行访问,并且您可以将 chmod 设置为 0770 并将目录 chown 给特定组。
否则,就没有 apaches“mod_auth”的概念,您可以在 samba 中按目录使用它,一旦用户进入共享,“可浏览”选项对所有文件都是全局的。
另一种可能性是为不同的组创建单独的共享。