Docker鏡像搭建ubuntu下samba目錄共享

時間 2019-12-08

標籤 docker 鏡像搭建 ubuntu samba 目錄共享欄目 Docker 简体版

原文原文鏈接

第一種方法：（未使用）

yum install docker
// 下載鏡像
docker pull dperson/samba
// 啓動鏡像，具體看文檔，但重要的配置是如下的註釋
docker run --name samba \ 
-it -p 139:139 -p 445:445 \
-v /home/technofiend:/home/technofiend \               #共享目錄
-d dperson/samba \
-u "www;thisispasswd" \                                #訪問用戶
-s "technofiend;/home/technofiend/;yes;no;no;all;none" #共享配置
// 密碼跟本機一致，1001爲用戶id，具體查看你本機的/etc/passwd文件，設置爲共享目錄所屬用戶
docker exec -it samba sed -i 's/1000/1001/g' /etc/passwd 
// 組跟本機一致，1001爲組id，具體查看你本機的/etc/group文件，設置爲共享目錄所屬組
docker exec -it samba sed -i 's/1000/1001/g' /etc/group
// 替換samba的啓動用戶，與權限有關
docker exec -it samba sed -i 's/force user = smbuser/force user = www/g' /etc/samba/smb.conf
// 替換samba的啓動組，與權限有關
docker exec -it samba sed -i 's/force group = users/force group = www/g' /etc/samba/smb.conf
// 重啓samba
docker restart samba

用戶id那塊看清楚了。但docker實例裏面新建的第一個用戶是1000.這裏跟你主機的用戶權限須要一直，因此得替換成一樣的id，用戶和組也得要
就是新進容器建這個用戶

第一種方法

第二種方法：（實驗成功）

第一步安裝docker：ios

yum install docker-engine

第二步啓動服務：git

service docker start

第三步：github

docker pull dperson/samba 第四步： docker run -it --name samba -p 139:139 -p 445:445 -v /home:/mount -d dperson/samba -u "www;overkill" -s "www;/mount/;yes;no;no;all;none"web

開放了139和445端口。用服務器訪問便可！sql

要是想把容器的權限與宿主主機的用戶權限一致的話，則只須要把用戶和組文件映射到容器裏面便可：docker

docker run -it --name samba -p 139:139 -p 445:445 -v /home:/mount -v /etc/passwd:/etc/passwd -v /etc/group:/etc/group -d dperson/samba -s "www;/mount/;yes;no;no;all;none"shell

請注意 -s 參數後面的第一個；前面的是現已存在的用戶名。ubuntu

官方使用教程：https://github.com/dperson/samba安全

3、配置方法

系統：ubuntu16.04服務器

配置文件：/etc/samba/smb.conf

Samba的主配置文件叫smb.conf，默認在/etc/samba/目錄下

smb.conf含有多個段，每一個段由段名開始，直到下個段名。每一個段名放在方括號中間。每段的參數的格式是：名稱=指。配置文件中一行一個段名和參數，段名和參數名不分大小寫。

除了[global]段外，全部的段均可以看做是一個共享資源。段名是該共享資源的名字，段裏的參數是該共享資源的屬性。

Samba安裝好後，使用testparm命令能夠測試smb.conf配置是否正確。使用testparm –v命令能夠詳細的列出smb.conf支持的配置參數

配置文件詳解

# This is the main Samba configuration file. You should read the
# smb.conf(5) manual page in order to understand the options listed
# here. Samba has a huge number of configurable options (perhaps too
# many!) most of which are not shown in this example
#
# Any line which starts with a ; (semi-colon) or a # (hash) 
# is a comment and is ignored. In this example we will use a #
# for commentry and a ; for parts of the config file that you
# may wish to enable
#
# NOTE: Whenever you modify this file you should run the command "testparm"
# to check that you have not made any basic syntactic errors. 
#
#======================= Global Settings =====================================
[global]

# workgroup = NT-Domain-Name or Workgroup-Name
   workgroup = MYGROUP #設定 Samba Server 所要加入的工做組或者域
# server string is the equivalent of the NT Description field  server string = Samba Server
#設定 Samba Server 的註釋，能夠是任何字符串，也能夠不填。宏%v表示顯示Samba的版本號 
# This option is important for security. It allows you to restrict
# connections to machines which are on your local network. The
# following example restricts access to two C class networks and
# the "loopback" interface. For more examples of the syntax see
# the smb.conf man page
;   hosts allow = 192.168.1. 192.168.2. 127.
#表示容許鏈接到Samba Server的客戶端，多個參數以空格隔開。能夠用一個IP表示，也能夠用一個網段表示。hosts deny 與hosts allow 恰好相反。
# if you want to automatically load your printer list rather
# than setting them up individually then you'll need this
   printcap name = /dev/null
   load printers = no

# It should not be necessary to spell out the print system type unless
# yours is non-standard. Currently supported print systems include:
# bsd, sysv, plp, lprng, aix, hpux, qnx
   printing = bsd

# Uncomment this if you want a guest account, you must add this to /etc/passwd
# otherwise the user "nobody" is used
;  guest account = pcguest

# this tells Samba to use a separate log file for each machine
# that connects
   log file = /dev/stdout
#日誌文件的存儲位置以及日誌文件名稱
# Put a capping on the size of the log files (in Kb).
   max log size = 50 #設置Samba Server日誌文件的最大容量，單位爲kB，0表明不限制
# Security mode. Most people will want user level security. See
# security_level.txt for details.
   security = user
#用戶訪問Samba Server的驗證方式

#1. share：用戶訪問Samba Server不須要提供用戶名和口令, 安全性能較低。

#2. user：Samba Server共享目錄只能被受權的用戶訪問,由Samba Server負責檢查帳號和密碼的正確性。帳號和密碼要在本Samba Server中創建。

#3. server：依靠其餘Windows NT/2000或Samba Server來驗證用戶的帳號和密碼,是一種代理驗證。此種安全模式下,系統管理員能夠把全部的Windows用戶和口令集中到一個NT系統上,使用Windows NT進行Samba認證, 遠程服務器能夠自動認證所有用戶和口令,若是認證失敗,Samba將使用用戶級安全模式做爲替代的方式。

#4. domain：域安全級別,使用主域控制器(PDC)來完成認

# Use password server option only with security = server

;   password server = <NT-Server-Name>

# Password Level allows matching of _n_ characters of the password for
# all combinations of upper and lower case.
;  username level = 8

# You may wish to use password encryption. Please read
# ENCRYPTION.txt, Win95.txt and WinNT.txt in the Samba documentation.
# Do not enable this option unless you have read those documents
;  encrypt passwords = yes
;  smb passwd file = /etc/samba/smbpasswd

# The following are needed to allow password changing from Windows to
# update the Linux sytsem password also.
# NOTE: Use these with 'encrypt passwords' and 'smb passwd file' above.
# NOTE2: You do NOT need these to allow workstations to change only
#        the encrypted SMB passwords. They allow the Unix password
#        to be kept in sync with the SMB password.
   unix password sync = no
;  passwd program = /usr/bin/passwd %u
;  passwd chat = *New*UNIX*password* %n\n *ReType*new*UNIX*password* %n\n *passwd:*all*authentication*tokens*updated*successfully*

# Unix users can map to different SMB User names
;  username map = /etc/samba/smbusers

# Using the following line enables you to customise your configuration
# on a per machine basis. The %m gets replaced with the netbios name
# of the machine that is connecting
;   include = /etc/samba/smb.conf.%m

# Configure Samba to use multiple interfaces
# If you have multiple network interfaces then you must list them
# here. See the man page for details.
;   interfaces = 192.168.12.2/24 192.168.13.2/24 

# Configure remote browse list synchronisation here
#  request announcement to, or browse list sync from:
#    a specific host or from / to a whole subnet (see below)
;   remote browse sync = 192.168.3.25 192.168.5.255
# Cause this host to announce itself to local subnets here
;   remote announce = 192.168.1.255 192.168.2.44

# Browser Control Options:
# set local master to no if you don't want Samba to become a master
# browser on your network. Otherwise the normal election rules apply
;   local master = no

# OS Level determines the precedence of this server in master browser
# elections. The default value should be reasonable
;   os level = 33

# Domain Master specifies Samba to be the Domain Master Browser. This
# allows Samba to collate browse lists between subnets. Don't use this
# if you already have a Windows NT domain controller doing this job
;   domain master = yes 

# Preferred Master causes Samba to force a local browser election on startup
# and gives it a slightly higher chance of winning the election
;   preferred master = yes

# Use only if you have an NT server on your network that has been
# configured at install time to be a primary domain controller.
;   domain controller = <NT-Domain-Controller-SMBName>

# Enable this if you want Samba to be a domain logon server for 
# Windows95 workstations. 
;   domain logons = yes

# if you enable domain logons then you may want a per-machine or
# per user logon script
# run a specific logon batch file per workstation (machine)
;   logon script = %m.bat
# run a specific logon batch file per username
;   logon script = %U.bat

# Where to store roving profiles (only for Win95 and WinNT)
#        %L substitutes for this servers netbios name, %U is username
#        You must uncomment the [Profiles] share below
;   logon path = \\%L\Profiles\%U

# All NetBIOS names must be resolved to IP Addresses
# 'Name Resolve Order' allows the named resolution mechanism to be specified
# the default order is "host lmhosts wins bcast". "host" means use the unix
# system gethostbyname() function call that will use either /etc/hosts OR
# DNS or NIS depending on the settings of /etc/host.config, /etc/nsswitch.conf
# and the /etc/resolv.conf file. "host" therefore is system configuration
# dependant. This parameter is most often of use to prevent DNS lookups
# in order to resolve NetBIOS names to IP Addresses. Use with care!
# The example below excludes use of name resolution for machines that are NOT
# on the local network segment
# - OR - are not deliberately to be known via lmhosts or via WINS.
; name resolve order = wins lmhosts bcast

# Windows Internet Name Serving Support Section:
# WINS Support - Tells the NMBD component of Samba to enable it's WINS Server
;   wins support = yes

# WINS Server - Tells the NMBD components of Samba to be a WINS Client
#    Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
;   wins server = w.x.y.z

# WINS Proxy - Tells Samba to answer name resolution queries on
# behalf of a non WINS capable client, for this to work there must be
# at least one    WINS Server on the network. The default is NO.
;   wins proxy = yes

# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
# via DNS nslookups. The built-in default for versions 1.9.17 is yes,
# this has been changed in version 1.9.18 to no.
   dns proxy = no 

# Case Preservation can be handy - system default is _no_
# NOTE: These can be set on a per share basis
   preserve case = yes
   short preserve case = yes
# Default case is normally upper case for all DOS files
   default case = lower
# Be very careful with case sensitivity - it can break things!
;  case sensitive = no

   pam password change = yes
   map to guest = bad user
   usershare allow guests = yes
   create mask = 0664
   force create mode = 0664
   directory mask = 0775
   force directory mode = 0775
#   force user = www
#   force group = www
   follow symlinks = yes
   load printers = no
   printing = bsd
   printcap name = /dev/null
   disable spoolss = yes
   socket options = TCP_NODELAY
   strict locking = no
   vfs objects = recycle
   recycle:keeptree = yes
   recycle:versions = yes
   min protocol = SMB2

[公共文件]
   path = /home/technofiend/public
   browsable = yes   #用來指定該共享是否能夠瀏覽
   read only = no
   guest ok = no    #將設置客戶端以該遊客帳號來訪問共享
   veto files = /._*/.apdisk/.AppleDouble/.DS_Store/.TemporaryItems/.Trashes/desktop.ini/ehthumbs.db/Network Trash Folder/Temporary Items/Thumbs.db/
   delete veto files = yes
   valid users = @public
[網絡開發文件] 
   comment = group-web  #對該共享的描述，能夠是任意字符串    path = /home/technofiend/group/web  #共享目錄路徑 public = yes        #用來指定該共享是否容許guest帳戶訪問
   writable = yes     #用來指定該共享路徑是否可寫
   printable = no     
   valid users = @web  #容許訪問該共享的用戶,組就用「@+組名」表示
[引擎開發文件]
  comment = ue4 
 path = /home/technofiend/group/editor 
  public = yes    #用來指定該共享是否容許guest帳戶訪問
  writable = yes  #用來指定該共享路徑是否可寫 
  printable = no 
  valid users = @editor 
[設計內部文件]
  comment = group public 
  path = /home/technofiend/group/public
  public = yes    writable = yes #用來指定該共享路徑是否可寫                                                                                                                                                                       
  printable = no  
  valid users = @seji #容許訪問該共享的用戶,組就用「@+組名」表示

service smb restart 重啓服務

檢查語法是否正確：testparm -v

思路方法：

1）建立組：添加用戶組
groupadd public 建立用戶組

useradd -s /sbin/nologin -G web,public,group-public webtest1 添加到多個用戶組

usermod -g seji cesiyonghu 添加到組

注意：useradd和adduser區別

useradd與adduser都是建立新的用戶
在CentOs下useradd與adduser是沒有區別的都是在建立用戶，在home下自動建立目錄，沒有設置密碼，須要使用passwd命令修改密碼。
而在Ubuntu下useradd與adduser有所不一樣
1、useradd在使用該命令建立用戶是不會在/home下自動建立與用戶名同名的用戶目錄，並且不會自動選擇shell版本，也沒有設置密碼，那麼這個用戶是不能登陸的，須要使用passwd命令修改密碼。
2、adduser在使用該命令建立用戶是會在/home下自動建立與用戶名同名的用戶目錄，系統shell版本，會在建立時會提示輸入密碼，更加友好。
 
userdel 刪除用戶，
userdel只能刪除用戶，並不會刪除相關的目錄文件。userdel -r 能夠刪除用戶及相關目錄。

View Code

2）變動文件夾的用戶和用戶組權限
chown -R :web group/web #表示全部web組

3）把用戶添加到samba中
smbpasswd -a share #設置密碼
4）激活用戶

smbpasswd -e share

5）window下使用; 運行----輸入\\ip地址

文章出處：

http://blog.csdn.net/technofiend/article/details/52346303 主要轉載這篇

http://blog.csdn.net/technofiend/article/details/51066262

更多註釋詳解:http://blog.csdn.net/dhgao38/article/details/43567403