目次 >> samba
LAN内でsambaを使って、Windowsパソコンなどとファイルを共有する。
sambaを設定する際は、一時的にファイアウォールおよびSELinuxを切っておくことを勧める。接続できないなどのトラブルが起きた際に、sambaの設定が原因ではなく、これらの設定によりつながらないという場合も多いからである。sambaが正常に動作することがわかった後に、ファイアウォールなどを設定した方が原因が切り分けやすくなる。
ubuntu 10.04の場合、apt-get install sambaでインストールする。
$ sudo apt-get install samba
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages were automatically installed and are no longer required:
linux-headers-2.6.32-21-generic linux-headers-2.6.32-21
Use 'apt-get autoremove' to remove them.
Suggested packages:
openbsd-inetd inet-superserver smbldap-tools ldb-tools
The following NEW packages will be installed:
samba
0 upgraded, 1 newly installed, 0 to remove and 2 not upgraded.
Need to get 6,819kB of archives.
After this operation, 18.4MB of additional disk space will be used.
Get:1 http://us.archive.ubuntu.com/ubuntu/ lucid/main samba 2:3.4.7~dfsg-1ubuntu3 [6,819kB]
Fetched 6,819kB in 10s (653kB/s)
Preconfiguring packages ...
Selecting previously deselected package samba.
(Reading database ... 149385 files and directories currently installed.)
Unpacking samba (from .../samba_2%3a3.4.7~dfsg-1ubuntu3_amd64.deb) ...
Processing triggers for man-db ...
Processing triggers for ufw ...
Processing triggers for ureadahead ...
Setting up samba (2:3.4.7~dfsg-1ubuntu3) ...
Generating /etc/default/samba...
Importing account for nobody...ok
Importing account for satodadmin...ok
Importing account for satod...ok
update-alternatives: using /usr/bin/smbstatus.samba3 to provide /usr/bin/smbstatus (smbstatus) in auto mode.
smbd start/running, process 15170
nmbd start/running, process 15178
yum install sambaでインストールする。
# yum install samba
Loaded plugins: refresh-packagekit
Setting up Install Process
Parsing package install arguments
Resolving Dependencies
--> Running transaction check
---> Package samba.x86_64 0:3.2.4-0.22.fc10 set to be updated
--> Processing Dependency: perl(Convert::ASN1) for package: samba
--> Running transaction check
---> Package perl-Convert-ASN1.noarch 0:0.21-3.fc9 set to be updated
--> Finished Dependency Resolution
Dependencies Resolved
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
samba x86_64 3.2.4-0.22.fc10 fedora 4.0 M
Installing for dependencies:
perl-Convert-ASN1 noarch 0.21-3.fc9 fedora 42 k
Transaction Summary
================================================================================
Install 2 Package(s)
Update 0 Package(s)
Remove 0 Package(s)
Total download size: 4.0 M
Is this ok [y/N]: y
Downloading Packages:
(1/2): perl-Convert-ASN1-0.21-3.fc9.noarch.rpm | 42 kB 00:00
(2/2): samba-3.2.4-0.22.fc10.x86_64.rpm | 4.0 MB 00:04
--------------------------------------------------------------------------------
Total 183 kB/s | 4.0 MB 00:22
Running rpm_check_debug
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
Installing : perl-Convert-ASN1 1/2
Installing : samba 2/2
Installed:
samba.x86_64 0:3.2.4-0.22.fc10
Dependency Installed:
perl-Convert-ASN1.noarch 0:0.21-3.fc9
Complete!
主要な設定は（FC4、FC5、openSUSE 10.0、ubuntu 7.10）
/etc/samba/smb.conf
で行う。
[共有名]でアクセス可能な共有フォルダを作成するが、[global]、[homes]、[printers]の各セクションは、特殊な設定を行うセクションである。
参考：http://www.samba.gr.jp/project/translation/3.0/htmldocs/
参考：http://www.samba.gr.jp/project/translation/3.0/htmldocs/smb.conf.5.html
FC5のデフォルトでは下記のようになっている。
# This is the main Samba configuration file. You should read the # smb.conf(5) manual page in order to understand the options listed # here. Samba has a huge number of configurable options (perhaps too # many!) most of which are not shown in this example # # Any line which starts with a ; (semi-colon) or a # (hash) # is a comment and is ignored. In this example we will use a # # for commentry and a ; for parts of the config file that you # may wish to enable # # NOTE: Whenever you modify this file you should run the command "testparm" # to check that you have not made any basic syntactic errors. # #======================= Global Settings ===================================== [global] # workgroup = NT-Domain-Name or Workgroup-Name workgroup = MYGROUP # server string is the equivalent of the NT Description field server string = Samba Server # This option is important for security. It allows you to restrict # connections to machines which are on your local network. The # following example restricts access to two C class networks and # the "loopback" interface. For more examples of the syntax see # the smb.conf man page ; hosts allow = 192.168.1. 192.168.2. 127. # if you want to automatically load your printer list rather # than setting them up individually then you'll need this printcap name = /etc/printcap load printers = yes # It should not be necessary to spell out the print system type unless # yours is non-standard. Currently supported print systems include: # bsd, sysv, plp, lprng, aix, hpux, qnx ; printing = cups # This option tells cups that the data has already been rasterized cups options = raw # Uncomment this if you want a guest account, you must add this to /etc/passwd # otherwise the user "nobody" is used ; guest account = pcguest # this tells Samba to use a separate log file for each machine # that connects log file = /var/log/samba/%m.log # all log information in one file # log file = /var/log/samba/log.smbd # Put a capping on the size of the log files (in Kb). max log size = 50 # Security mode. Most people will want user level security. See # security_level.txt for details. security = user # Use password server option only with security = server ; password server = <NT-Server-Name> # Password Level allows matching of _n_ characters of the password for # all combinations of upper and lower case. ; password level = 8 ; username level = 8 # You may wish to use password encryption. Please read # ENCRYPTION.txt, Win95.txt and WinNT.txt in the Samba documentation. # Do not enable this option unless you have read those documents ; encrypt passwords = yes ; smb passwd file = /etc/samba/smbpasswd # The following are needed to allow password changing from Windows to # update the Linux system password also. # NOTE: Use these with 'encrypt passwords' and 'smb passwd file' above. # NOTE2: You do NOT need these to allow workstations to change only # the encrypted SMB passwords. They allow the Unix password # to be kept in sync with the SMB password. ; unix password sync = Yes ; passwd program = /usr/bin/passwd %u ; passwd chat = *New*UNIX*password* %n\n *ReType*new*UNIX*password* %n\n *passwd:*all*authentication*tokens*updated*successfully* # Unix users can map to different SMB User names ; username map = /etc/samba/smbusers # Using the following line enables you to customise your configuration # on a per machine basis. The %m gets replaced with the netbios name # of the machine that is connecting ; include = /etc/samba/smb.conf.%m # Most people will find that this option gives better performance. # See speed.txt and the manual pages for details socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 # Configure Samba to use multiple interfaces # If you have multiple network interfaces then you must list them # here. See the man page for details. ; interfaces = 192.168.12.2/24 192.168.13.2/24 # Configure remote browse list synchronisation here # request announcement to, or browse list sync from: # a specific host or from / to a whole subnet (see below) ; remote browse sync = 192.168.3.25 192.168.5.255 # Cause this host to announce itself to local subnets here ; remote announce = 192.168.1.255 192.168.2.44 # Browser Control Options: # set local master to no if you don't want Samba to become a master # browser on your network. Otherwise the normal election rules apply ; local master = no # OS Level determines the precedence of this server in master browser # elections. The default value should be reasonable ; os level = 33 # Domain Master specifies Samba to be the Domain Master Browser. This # allows Samba to collate browse lists between subnets. Don't use this # if you already have a Windows NT domain controller doing this job ; domain master = yes # Preferred Master causes Samba to force a local browser election on startup # and gives it a slightly higher chance of winning the election ; preferred master = yes # Enable this if you want Samba to be a domain logon server for # Windows95 workstations. ; domain logons = yes # if you enable domain logons then you may want a per-machine or # per user logon script # run a specific logon batch file per workstation (machine) ; logon script = %m.bat # run a specific logon batch file per username ; logon script = %U.bat # Where to store roving profiles (only for Win95 and WinNT) # %L substitutes for this servers netbios name, %U is username # You must uncomment the [Profiles] share below ; logon path = \\%L\Profiles\%U # All NetBIOS names must be resolved to IP Addresses # 'Name Resolve Order' allows the named resolution mechanism to be specified # the default order is "host lmhosts wins bcast". "host" means use the unix # system gethostbyname() function call that will use either /etc/hosts OR # DNS or NIS depending on the settings of /etc/host.config, /etc/nsswitch.conf # and the /etc/resolv.conf file. "host" therefore is system configuration # dependant. This parameter is most often of use to prevent DNS lookups # in order to resolve NetBIOS names to IP Addresses. Use with care! # The example below excludes use of name resolution for machines that are NOT # on the local network segment # - OR - are not deliberately to be known via lmhosts or via WINS. ; name resolve order = wins lmhosts bcast # Windows Internet Name Serving Support Section: # WINS Support - Tells the NMBD component of Samba to enable it's WINS Server ; wins support = yes # WINS Server - Tells the NMBD components of Samba to be a WINS Client # Note: Samba can be either a WINS Server, or a WINS Client, but NOT both ; wins server = w.x.y.z # WINS Proxy - Tells Samba to answer name resolution queries on # behalf of a non WINS capable client, for this to work there must be # at least one WINS Server on the network. The default is NO. ; wins proxy = yes # DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names # via DNS nslookups. The built-in default for versions 1.9.17 is yes, # this has been changed in version 1.9.18 to no. dns proxy = no # Case Preservation can be handy - system default is _no_ # NOTE: These can be set on a per share basis ; preserve case = no ; short preserve case = no # Default case is normally upper case for all DOS files ; default case = lower # Be very careful with case sensitivity - it can break things! ; case sensitive = no #============================ Share Definitions ============================== [homes] comment = Home Directories browseable = no writable = yes # Un-comment the following and create the netlogon directory for Domain Logons ; [netlogon] ; comment = Network Logon Service ; path = /home/netlogon ; guest ok = yes ; writable = no ; share modes = no # Un-comment the following to provide a specific roving profile share # the default is to use the user's home directory ;[Profiles] ; path = /home/profiles ; browseable = no ; guest ok = yes # NOTE: If you have a BSD-style print system there is no need to # specifically define each individual printer [printers] comment = All Printers path = /var/spool/samba browseable = no # Set public = yes to allow user 'guest account' to print guest ok = no writable = no printable = yes # This one is useful for people to share files ;[tmp] ; comment = Temporary file space ; path = /tmp ; read only = no ; public = yes # A publicly accessible directory, but read only, except for people in # the "staff" group ;[public] ; comment = Public Stuff ; path = /home/samba ; public = yes ; read only = yes ; write list = @staff # Other examples. # # A private printer, usable only by fred. Spool data will be placed in fred's # home directory. Note that fred must have write access to the spool directory, # wherever it is. ;[fredsprn] ; comment = Fred's Printer ; valid users = fred ; path = /homes/fred ; printer = freds_printer ; public = no ; writable = no ; printable = yes # A private directory, usable only by fred. Note that fred requires write # access to the directory. ;[fredsdir] ; comment = Fred's Service ; path = /usr/somewhere/private ; valid users = fred ; public = no ; writable = yes ; printable = no # a service which has a different directory for each machine that connects # this allows you to tailor configurations to incoming machines. You could # also use the %u option to tailor it by user name. # The %m gets replaced with the machine name that is connecting. ;[pchome] ; comment = PC Directories ; path = /usr/pc/%m ; public = no ; writable = yes # A publicly accessible directory, read/write to all users. Note that all files # created in the directory by users will be owned by the default user, so # any user with access can delete any other user's files. Obviously this # directory must be writable by the default user. Another user could of course # be specified, in which case all files would be owned by that user instead. ;[public] ; path = /usr/somewhere/else/public ; public = yes ; only guest = yes ; writable = yes ; printable = no # The following two entries demonstrate how to share a directory so that two # users can place files there that will be owned by the specific users. In this # setup, the directory should be writable by both users and should have the # sticky bit set on it to prevent abuse. Obviously this could be extended to # as many users as required. ;[myshare] ; comment = Mary's and Fred's stuff ; path = /usr/somewhere/shared ; valid users = mary fred ; public = no ; writable = yes ; printable = no ; create mask = 0765
[global]では、samba全体の設定を行う。以下、記述順序は関係ない。
| 項目 | 設定値 | デフォルト | 内容 |
|---|---|---|---|
| netbios name | 文字列 | PCのDNS名 | ネットワークコンピュータ名 |
| server string | 文字列 | なし | ネットワークコンピュータで表示される説明文字列 |
| security | share|user|domain | user | セキュリティモデルを指定する。userの場合、アクセスする際に、ユーザー名とパスワードが自動的に送信される。shareの場合、ユーザー名とパスワードを入力する必要があり、このユーザー名とパスワードを知っている人なら誰でも共有フォルダにアクセスできる。domainはドメインを使用するときに使う。 |
| workgroup | 文字列 | WORKGROUP | ワークグループ名を指定する |
| wins support | Yes|No | No | wins support, prefered master, local master, os levelの項目を調整することで、ネットワーク内のほかのパソコンを見えるようにする。 |
| preferred master | Yes|No | auto | Yesにするとワークグループのマスタブラウザになりやすくなる |
| local master | Yes|No | auto | |
| os level | 数値 | 20 | 数値が高いほど優先順位が高くなり、ローカルマスタブラウザになりやすくなる。 |
| map to guest | Bad User|Never | Never | この項目はsecurityがshare 以外の時のみ有効。Bad Userの場合、ゲストとしてのアクセスを許可します。Neverの場合、ゲストとしてはアクセスできません。 |
| hosts allow | IPアドレス | なし（全てOK） | アクセスを許可するIPアドレスを指定する。hosts denyと矛盾する場合allowが優先される |
| hosts deny | IPアドレス | なし | アクセスを拒否するIPアドレスを指定する。 |
| unix charset dos charset display charset |
なし | 文字化けする場合に変更する。 | |
| ldap ssl | |||
| printcap name |
各ユーザーが自分のユーザー名でアクセスしたときに、自分のホームディレクトリに接続されるようになる。すなわち、同じマシンから同じ共有名で接続しても、接続するユーザー名によって、接続されるディレクトリが変わる。
例えば、fooというユーザー名であれば、
\\example.com\foo
で自分のホームディレクトリにアクセスすることができる。
設定可能な項目一覧は、[共有名]セクションと共通。
| 項目 | 設定値 | デフォルト | 内容 |
|---|---|---|---|
| comment | 文字列 | なし | ネットワークコンピュータ名 |
| 項目 | 設定値 | デフォルト | 内容 |
|---|---|---|---|
| writeable | Yes|No | No | このフォルダへの書き込みを許可する |
| read only | Yes|No | Yes | writeableの逆 |
| guest only | Yes|No | No | このフォルダは常にguestユーザーでログインする |
| guest ok | Yes|No | No | guestアカウントでのログインを許可する |
| public | Yes|No | No | guest okと同義 |
| browseable | Yes|No | Yes | フォルダ一覧に表示する |
| create mask | 数値 | 0744 | ファイル作成時のパーミッションを指定する |
| comment | 文字列 | なし | server stringのフォルダ版。 |
| hide dot files | Yes|No | ||
| inherit acls | Yes|No | ||
| valid users | |||
| veto files | 文字列 | なし | アクセスを許可しないファイルを指定する。 |
パスワード不要でアクセスするディレクトリのみである場合はこの設定は不要
SambaはLinuxのユーザーが存在しているだけでは使えない。Sambaが独自に持つデータベースにユーザーを登録してやる必要がある。
sambaユーザーの追加はsmbpasswdを-aオプションをつけてrootで起動する。具体的には、fooというユーザー名のユーザーを追加するには
# smbpasswd -a foo
smbpasswdは各ユーザーも使うことができ、その際は自分のsambaのパスワードを変更することが出来る。この際に、globalセクションで
unix password sync = Yes
の設定がなされていると、Linuxのパスワードも同時に変更される。（その逆にpasswdでLinuxのパスワードを変更しても、samba側に反映するというようなことは出来ない。）
FC5の場合は、下記のコマンドでsmbとnmbの両方が起動される。
# /etc/init.d/smb startopenSUSE 10.0の場合は、必ず、smbとnmbデーモンの両方を手動で起動する必要がある。
Starting SMB services: [ OK ]
Starting NMB services: [ OK ]
# /etc/init.d/smb stop
Shutting down SMB services: [ OK ]
Shutting down NMB services: [ OK ]
# /etc/init.d/smb restart
Shutting down SMB services: [ OK ]
Shutting down NMB services: [ OK ]
Starting SMB services: [ OK ]
Starting NMB services: [ OK ]
/etc/init.d/smb start
/etc/init.d/nmb start
/etc/init.d/smb stop
/etc/init.d/nmb stop
/etc/init.d/smb restart
/etc/init.d/nmb restart
ubuntu 7.10では
$ sudo /etc/init.d/samba restart
* Stopping Samba daemons...
...done.
* Starting Samba daemons
...done.
サーバ起動時に自動起動するようにするには、
FC5では
# chkconfig smb on
念のため確認
# chkconfig smb --list
smb 0:off 1:off 2:on 3:on 4:on 5:on 6:off
openSUSE 10.0では
# chkconfig smb on
# chkconfig nmb on
念のため確認
# chkconfig smb --list
smb 0:off 1:off 2:off 3:on 4:off 5:on 6:off
# chkconfig nmb --list
nmb 0:off 1:off 2:off 3:on 4:off 5:on 6:off
sambaにうまく接続できないという場合の原因の解明はなかなか難しい。まずは、ファイアウォールなど、samba以外の原因を排除した後に、sambaの設定を見直す。sambaの設定の見直し方については下記のサイトを参照のこと。
参考：http://www.samba.gr.jp/doc/diag.html
以下いくつかの例をあげる
これは、会社内などで、ネットワークにつながったどのパソコンからも資料などにアクセスしたいが、ほかの人には勝手に書き換えられてしまっては困るなど、保護したい場合に適している。
[global] include = /etc/samba/dhcp.conf domain master = No map to guest = Bad User wins support = true netbios name = SERVER cups options = raw server string = smb workgroup = WORKGROUP os level = 65 server signing = auto printcap name = cups security = share add machine script = /usr/sbin/useradd -c Machine -d /var/lib/nobody -s /bin/false %m$
[global] workgroup = WORKGROUP server string = Samba Server log file = /var/log/samba/%m.log os level = 65 local master = yes preferred master = yes wins support = yes [public] path = /usr/somewhere/else/public public = yes only guest = yes writable = yes printable = no
これは、家庭内などで誰でも自由にアクセスできるネットワークドライブが必要な場合に適している。
LAN外のサーバのディレクトリをLAN内で使えるようにするには2つの方法がある。一つは、OpenVPNを使う方法、もう一つはsshfsを使う方法である。OpenVPNを使う方法では、クライアントは遠隔地のサーバに直接つなぎにいく。一方、sshfsを使う方法では、LAN内のサーバが、sshfsで遠隔地のサーバのディレクトリをマウントして、それをsambaで公開する。詳しいやり方についてはそれぞれの解説ページを参照されたし。