débutant sur samba

Lolo_D · 07-10-2022 12:54:48

bonjour à vous,

Après avoir un peu travaillé mes lignes de commande et mon petit pc linux, j'essaye de développer un peu le sujet !
j'essaye d'installer un petit labo virtuel pour travailler sur des tâches de base linux...
mon labo comprend :
- un pare-feu pfsense
- un pc debian 11
- un pc windows 10 pro
- un serveur debian 11.

J'essaye de faciliter les transferts entre les clients et le serveur en installant un samba mais j'ai un petit souci technique.
J'ai installé samba sur le serveur debian 11 depuis apt.

cat /etc/samba/smb.conf

# Sample configuration file for the Samba suite for Debian GNU/Linux.

#

#

# This is the main Samba configuration file. You should read the

# smb.conf(5) manual page in order to understand the options listed

# here. Samba has a huge number of configurable options most of which

# are not shown in this example

#

# Some options that are often worth tuning have been included as

# commented-out examples in this file.

#  - When such options are commented with ";", the proposed setting

#    differs from the default Samba behaviour

#  - When commented with "#", the proposed setting is the default

#    behaviour of Samba but the option is considered important

#    enough to be mentioned here

#

# NOTE: Whenever you modify this file you should run the command

# "testparm" to check that you have not made any basic syntactic

# errors.

#======================= Global Settings =======================

[global]

## Browsing/Identification ###

# Change this to the workgroup/NT-domain name your Samba server will part of

   workgroup = WORKGROUP

#### Networking ####

# The specific set of interfaces / networks to bind to

# This can be either the interface name or an IP address/netmask;

# interface names are normally preferred

;   interfaces = 127.0.0.0/8 eth0

# Only bind to the named interfaces and/or networks; you must use the

# 'interfaces' option above to use this.

# It is recommended that you enable this feature if your Samba machine is

# not protected by a firewall or is a firewall itself.  However, this

# option cannot handle dynamic or non-broadcast interfaces correctly.

;   bind interfaces only = yes

#### Debugging/Accounting ####

# This tells Samba to use a separate log file for each machine

# that connects

   log file = /var/log/samba/log.%m

# Cap the size of the individual log files (in KiB).

   max log size = 1000

# We want Samba to only log to /var/log/samba/log.{smbd,nmbd}.

# Append syslog@1 if you want important messages to be sent to syslog too.

   logging = file

# Do something sensible when Samba crashes: mail the admin a backtrace

   panic action = /usr/share/samba/panic-action %d

####### Authentication #######

# Server role. Defines in which mode Samba will operate. Possible

# values are "standalone server", "member server", "classic primary

# domain controller", "classic backup domain controller", "active

# directory domain controller".

#

# Most people will want "standalone server" or "member server".

# Running as "active directory domain controller" will require first

# running "samba-tool domain provision" to wipe databases and create a

# new domain.

   server role = standalone server

   obey pam restrictions = yes

# This boolean parameter controls whether Samba attempts to sync the Unix

# password with the SMB password when the encrypted SMB password in the

# passdb is changed.

   unix password sync = yes

# For Unix password sync to work on a Debian GNU/Linux system, the following

# parameters must be set (thanks to Ian Kahan <<kahan@informatik.tu-muenchen.de> for

# sending the correct chat script for the passwd program in Debian Sarge).

   passwd program = /usr/bin/passwd %u

   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .

# This boolean controls whether PAM will be used for password changes

# when requested by an SMB client instead of the program listed in

# 'passwd program'. The default is 'no'.

   pam password change = yes

# This option controls how unsuccessful authentication attempts are mapped

# to anonymous connections

   map to guest = bad user

########## Domains ###########

#

# The following settings only takes effect if 'server role = classic

# primary domain controller', 'server role = classic backup domain controller'

# or 'domain logons' is set

#

# It specifies the location of the user's

# profile directory from the client point of view) The following

# required a [profiles] share to be setup on the samba server (see

# below)

;   logon path = \\%N\profiles\%U

# Another common choice is storing the profile in the user's home directory

# (this is Samba's default)

#   logon path = \\%N\%U\profile

# The following setting only takes effect if 'domain logons' is set

# It specifies the location of a user's home directory (from the client

# point of view)

;   logon drive = H:

#   logon home = \\%N\%U

# The following setting only takes effect if 'domain logons' is set

# It specifies the script to run during logon. The script must be stored

# in the [netlogon] share

# NOTE: Must be store in 'DOS' file format convention

;   logon script = logon.cmd

# This allows Unix users to be created on the domain controller via the SAMR

# RPC pipe.  The example command creates a user account with a disabled Unix

# password; please adapt to your needs

; add user script = /usr/sbin/adduser --quiet --disabled-password --gecos "" %u

# This allows machine accounts to be created on the domain controller via the

# SAMR RPC pipe.

# The following assumes a "machines" group exists on the system

; add machine script  = /usr/sbin/useradd -g machines -c "%u machine account" -d /var/lib/samba -s /bin/false %u

# This allows Unix groups to be created on the domain controller via the SAMR

# RPC pipe.

; add group script = /usr/sbin/addgroup --force-badname %g

############ Misc ############

# Using the following line enables you to customise your configuration

# on a per machine basis. The %m gets replaced with the netbios name

# of the machine that is connecting

;   include = /home/samba/etc/smb.conf.%m

# Some defaults for winbind (make sure you're not using the ranges

# for something else.)

;   idmap config * :              backend = tdb

;   idmap config * :              range   = 3000-7999

;   idmap config YOURDOMAINHERE : backend = tdb

;   idmap config YOURDOMAINHERE : range   = 100000-999999

;   template shell = /bin/bash

# Setup usershare options to enable non-root users to share folders

# with the net usershare command.

# Maximum number of usershare. 0 means that usershare is disabled.

#   usershare max shares = 100

# Allow users who've been granted usershare privileges to create

# public shares, not just authenticated ones

   usershare allow guests = yes

#======================= Share Definitions =======================

#[homes]

#   comment = Home Directories

#   browseable = no

# By default, the home directories are exported read-only. Change the

# next parameter to 'no' if you want to be able to write to them.

  read only = yes

# File creation mask is set to 0700 for security reasons. If you want to

# create files with group=rw permissions, set next parameter to 0775.

   create mask = 0700

# Directory creation mask is set to 0700 for security reasons. If you want to

# create dirs. with group=rw permissions, set next parameter to 0775.

   directory mask = 0700

# By default, \\server\username shares can be connected to by anyone

# with access to the samba server.

# The following parameter makes sure that only "username" can connect

# to \\server\username

# This might need tweaking when using external authentication schemes

   valid users = %S

# Un-comment the following and create the netlogon directory for Domain Logons

# (you need to configure Samba to act as a domain controller too.)

;[netlogon]

;   comment = Network Logon Service

;   path = /home/samba/netlogon

;   guest ok = yes

;   read only = yes

# Un-comment the following and create the profiles directory to store

# users profiles (see the "logon path" option above)

# (you need to configure Samba to act as a domain controller too.)

# The path below should be writable by all users so that their

# profile directory may be created the first time they log on

;[profiles]

;   comment = Users profiles

;   path = /home/samba/profiles

;   guest ok = no

;   browseable = no

;   create mask = 0600

;   directory mask = 0700

[printers]

   comment = All Printers

   browseable = no

   path = /var/spool/samba

   printable = yes

   guest ok = no

   read only = yes

   create mask = 0700

[partage]

        comment = Partage de données

        path = /srv/partagesmb

        guest ok = no

        read only = no

        browseable = yes

        valid users = laurenttech, charlotte, @tech

        create mask = 0660

        directory mask = 0770

        force groupe = partage

# Windows clients look for this share name as a source of downloadable

# printer drivers

[print$]

   comment = Printer Drivers

   path = /var/lib/samba/printers

   browseable = yes

   read only = yes

   guest ok = no

# Uncomment to allow remote administration of Windows print drivers.

# You may need to replace 'lpadmin' with the name of the group your

# admin users are members of.

# Please note that you also need to set appropriate Unix permissions

# to the drivers directory for these users to have write rights in it

;   write list = root, @lpadmin

laurenttech@srvdeb11:~$ cat /etc/samba/smb.conf

#

# Sample configuration file for the Samba suite for Debian GNU/Linux.

#

#

# This is the main Samba configuration file. You should read the

# smb.conf(5) manual page in order to understand the options listed

# here. Samba has a huge number of configurable options most of which

# are not shown in this example

#

# Some options that are often worth tuning have been included as

# commented-out examples in this file.

#  - When such options are commented with ";", the proposed setting

#    differs from the default Samba behaviour

#  - When commented with "#", the proposed setting is the default

#    behaviour of Samba but the option is considered important

#    enough to be mentioned here

#

# NOTE: Whenever you modify this file you should run the command

# "testparm" to check that you have not made any basic syntactic

# errors.

#======================= Global Settings =======================

[global]

## Browsing/Identification ###

# Change this to the workgroup/NT-domain name your Samba server will part of

   workgroup = WORKGROUP

#### Networking ####

# The specific set of interfaces / networks to bind to

# This can be either the interface name or an IP address/netmask;

# interface names are normally preferred

;   interfaces = 127.0.0.0/8 eth0

# Only bind to the named interfaces and/or networks; you must use the

# 'interfaces' option above to use this.

# It is recommended that you enable this feature if your Samba machine is

# not protected by a firewall or is a firewall itself.  However, this

# option cannot handle dynamic or non-broadcast interfaces correctly.

;   bind interfaces only = yes

#### Debugging/Accounting ####

# This tells Samba to use a separate log file for each machine

# that connects

   log file = /var/log/samba/log.%m

# Cap the size of the individual log files (in KiB).

   max log size = 1000

# We want Samba to only log to /var/log/samba/log.{smbd,nmbd}.

# Append syslog@1 if you want important messages to be sent to syslog too.

   logging = file

# Do something sensible when Samba crashes: mail the admin a backtrace

   panic action = /usr/share/samba/panic-action %d

####### Authentication #######

# Server role. Defines in which mode Samba will operate. Possible

# values are "standalone server", "member server", "classic primary

# domain controller", "classic backup domain controller", "active

# directory domain controller".

#

# Most people will want "standalone server" or "member server".

# Running as "active directory domain controller" will require first

# running "samba-tool domain provision" to wipe databases and create a

# new domain.

   server role = standalone server

   obey pam restrictions = yes

# This boolean parameter controls whether Samba attempts to sync the Unix

# password with the SMB password when the encrypted SMB password in the

# passdb is changed.

   unix password sync = yes

# For Unix password sync to work on a Debian GNU/Linux system, the following

# parameters must be set (thanks to Ian Kahan <<kahan@informatik.tu-muenchen.de> for

# sending the correct chat script for the passwd program in Debian Sarge).

   passwd program = /usr/bin/passwd %u

   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .

# This boolean controls whether PAM will be used for password changes

# when requested by an SMB client instead of the program listed in

# 'passwd program'. The default is 'no'.

   pam password change = yes

# This option controls how unsuccessful authentication attempts are mapped

# to anonymous connections

   map to guest = bad user

########## Domains ###########

#

# The following settings only takes effect if 'server role = classic

# primary domain controller', 'server role = classic backup domain controller'

# or 'domain logons' is set

#

# It specifies the location of the user's

# profile directory from the client point of view) The following

# required a [profiles] share to be setup on the samba server (see

# below)

;   logon path = \\%N\profiles\%U

# Another common choice is storing the profile in the user's home directory

# (this is Samba's default)

#   logon path = \\%N\%U\profile

# The following setting only takes effect if 'domain logons' is set

# It specifies the location of a user's home directory (from the client

# point of view)

;   logon drive = H:

#   logon home = \\%N\%U

# The following setting only takes effect if 'domain logons' is set

# It specifies the script to run during logon. The script must be stored

# in the [netlogon] share

# NOTE: Must be store in 'DOS' file format convention

;   logon script = logon.cmd

# This allows Unix users to be created on the domain controller via the SAMR

# RPC pipe.  The example command creates a user account with a disabled Unix

# password; please adapt to your needs

; add user script = /usr/sbin/adduser --quiet --disabled-password --gecos "" %u

# This allows machine accounts to be created on the domain controller via the

# SAMR RPC pipe.

# The following assumes a "machines" group exists on the system

; add machine script  = /usr/sbin/useradd -g machines -c "%u machine account" -d /var/lib/samba -s /bin/false %u

# This allows Unix groups to be created on the domain controller via the SAMR

# RPC pipe.

; add group script = /usr/sbin/addgroup --force-badname %g

############ Misc ############

# Using the following line enables you to customise your configuration

# on a per machine basis. The %m gets replaced with the netbios name

# of the machine that is connecting

;   include = /home/samba/etc/smb.conf.%m

# Some defaults for winbind (make sure you're not using the ranges

# for something else.)

;   idmap config * :              backend = tdb

;   idmap config * :              range   = 3000-7999

;   idmap config YOURDOMAINHERE : backend = tdb

;   idmap config YOURDOMAINHERE : range   = 100000-999999

;   template shell = /bin/bash

# Setup usershare options to enable non-root users to share folders

# with the net usershare command.

# Maximum number of usershare. 0 means that usershare is disabled.

#   usershare max shares = 100

# Allow users who've been granted usershare privileges to create

# public shares, not just authenticated ones

   usershare allow guests = yes

#======================= Share Definitions =======================

#[homes]

#   comment = Home Directories

#   browseable = no

# By default, the home directories are exported read-only. Change the

# next parameter to 'no' if you want to be able to write to them.

  read only = yes

# File creation mask is set to 0700 for security reasons. If you want to

# create files with group=rw permissions, set next parameter to 0775.

   create mask = 0700

# Directory creation mask is set to 0700 for security reasons. If you want to

# create dirs. with group=rw permissions, set next parameter to 0775.

   directory mask = 0700

# By default, \\server\username shares can be connected to by anyone

# with access to the samba server.

# The following parameter makes sure that only "username" can connect

# to \\server\username

# This might need tweaking when using external authentication schemes

   valid users = %S

# Un-comment the following and create the netlogon directory for Domain Logons

# (you need to configure Samba to act as a domain controller too.)

;[netlogon]

;   comment = Network Logon Service

;   path = /home/samba/netlogon

;   guest ok = yes

;   read only = yes

# Un-comment the following and create the profiles directory to store

# users profiles (see the "logon path" option above)

# (you need to configure Samba to act as a domain controller too.)

# The path below should be writable by all users so that their

# profile directory may be created the first time they log on

;[profiles]

;   comment = Users profiles

;   path = /home/samba/profiles

;   guest ok = no

;   browseable = no

;   create mask = 0600

;   directory mask = 0700

[printers]

   comment = All Printers

   browseable = no

   path = /var/spool/samba

   printable = yes

   guest ok = no

   read only = yes

   create mask = 0700

[partage]

        comment = Partage de données

        path = /srv/partagesmb

        guest ok = no

        read only = no

        browseable = yes

        valid users = laurenttech, charlotte, @tech

        create mask = 0660

        directory mask = 0770

        force groupe = grppartage

# Windows clients look for this share name as a source of downloadable

# printer drivers

[print$]

   comment = Printer Drivers

   path = /var/lib/samba/printers

   browseable = yes

   read only = yes

   guest ok = no

# Uncomment to allow remote administration of Windows print drivers.

# You may need to replace 'lpadmin' with the name of the group your

# admin users are members of.

# Please note that you also need to set appropriate Unix permissions

# to the drivers directory for these users to have write rights in it

;   write list = root, @lpadmin

pour les droits, ils sont ci-dessous :

ls -l /srv/

total 4

drwxrwxr-x 2 root grppartagesmb 4096  7 oct.  10:13 partagesmb

Les utilisateurs concernés par le partage sont dans le groupe grppartagesmb :

cat /etc/group |grep grppartagesmb 

grppartagesmb:x:1003:laurenttech,charlotte

Le mot de passe : laurenttech a été fait avec la commande suivante :

smbpasswd -a laurenttech

Je ne parviens pas à me connecter depuis mes pc...

Le PC windows ne reconnait pas. J'ai fait Win+R puis j'ai saisi \\192.168.31.200\srv\partagesmb\ et je n'ai rien pu faire...l'emplacement réseau n'existe pas.

Le partage et côté linux :
Depuis mon bureau Gnome, je m'étais rendu dans : Fichiers>Connexion à un serveur : smb://192.168.31.200/srv/partagesmb/
Le résultat est ci-dessous...

impossible d'accéder à l'emplacement 

impossible de monter le partage Windows :aucun fichier ou dossier de ce type 

Normalement, je n'ai aucun domaine d'actif. sur le serveur mon PC. Néamoins, lorsque je tape

cat /etc/resolve.conf

search mondomaine.lan

nameserver 8.8.8.8

Si quelqu'un a quelques éléments de compréhension, je suis preneur...j'ai dû faire des sotistes quelque part mais je ne vois pas où.

bien à vous,

Lolo_D · 14-10-2022 07:16:40

bonjour,

petite question, est-ce que cela pourrait venir du fait que l'utilisateur noté dans linux ne porte pas le même nom que celui sur le serveur linux ? idem pour linux client ?
je suis preneur d'une info complémentaire...d'une piste à chercher ! je vous remercie par avance,

cordialement,

Lolo_D · 20-10-2022 08:01:38

...bon, ce sujet n'attire pas les foules

j'ai essayé de faire évoluer ma configuration sans succès...

Croutons · 20-10-2022 09:48:01

Hello
Ce que j'ai dans mes notes sur Samba
vois du coté du parefeu si il a pas des restrictions, j'ai noté qu'il fallait débloquer certain port pour communiquer avec Windows

en TCP et UDP (Localisateur de services RPC)

en TCP et UDP (NetBIOS Name Service)

en UDP (NetBIOS Datagram Service)

en TCP (NetBIOS Session Service)

en TCP et UDP (Services de dossiers partagés Windows)

la méthode la moins prise de tête pour faire du partage de dossier selon moi c'est de toujours utiliser la commande net
bon coté man c'est assez indigeste

man net 

net usershare add nomdupartage chemin "description" droits
exemple pour créer un partage

net usershare add Musique_partage /home/stephane/Musique/ "Musique partagé" everyone:F,"Unix User\stephane":F guest_ok=y

net usershare va créer un répertoire

/var/lib/samba/usershares/Musique_partage

pour consulter la liste des partages en cours

net usershare list  --long

connaître les droits associés

net usershare info --long

éventuellement suivis du nom du partage

man net a écrit :

USERSHARE
Starting with version 3.0.23, a Samba server now supports the ability for non-root users to add user defined shares to be exported using the "net usershare" commands.

To set this up, first set up your smb.conf by adding to the [global] section: usershare path = /usr/local/samba/lib/usershares Next create the directory /usr/local/samba/lib/usershares,
change the owner to root and set the group owner to the UNIX group who should have the ability to create usershares, for example a group called "serverops". Set the permissions on
/usr/local/samba/lib/usershares to 01770. (Owner and group all access, no access for others, plus the sticky bit, which means that a file in that directory can be renamed or deleted only by
the owner of the file). Finally, tell smbd how many usershares you will allow by adding to the [global] section of smb.conf a line such as : usershare max shares = 100. To allow 100
usershare definitions. Now, members of the UNIX group "serverops" can create user defined shares on demand using the commands below.

The usershare commands are:
net usershare add sharename path [comment [acl] [guest_ok=[y|n]]] - to add or change a user defined share.
net usershare delete sharename - to delete a user defined share.
net usershare info [-l|--long] [wildcard sharename] - to print info about a user defined share.
net usershare list [-l|--long] [wildcard sharename] - to list user defined shares.

a lire la
https://askubuntu.com/questions/143024/ … mmand-line
sa non net usershare info --long share_name > /var/lib/samba/usershares/share_name

action personnalisé pour thunar
https://askubuntu.com/questions/101350/ … -in-thunar

au départ il faut mettre en place le dossier et les informations dans la section global du samba.conf
car sinon on a ce type de message

net usershare: cannot open usershare directory /var/lib/samba/usershares. Error Aucun fichier ou dossier de ce type

Please ask your system administrator to enable user sharing.

Les différentes étape que j'ai noté
1) Create a group (must be done as root):

export USERSHARES_DIR="/var/lib/samba/usershares"
export USERSHARES_GROUP="sambashare"
mkdir -p ${USERSHARES_DIR}
groupadd ${USERSHARES_GROUP}
chown root:${USERSHARES_GROUP} ${USERSHARES_DIR}
chmod 01770 ${USERSHARES_DIR}

2) Use the following /etc/samba/smb.conf:

[global]
workgroup = WORKGROUP
usershare path = /var/lib/samba/usershares
usershare max shares = 100
usershare allow guests = yes
usershare owner only = yes

3) Add the samba group to your user (replace your_username by your login):

usermod -a -G ${USERSHARES_GROUP} your_username

4) Restart Samba daemons

Ex: /etc/init.d/samba restart

5) Logout and login your user (your_username)

une fois le fichier smb.conf modifié, tester que la syntaxe soit correct

testparm

test en VM ajout dans la section [global]
server min protocol = NT1
cependant ceci n'est peut être pas nécessaire, toujours est il que après un redémarrage de ma VM Bullseye les partage DEBIANVM sont vu par smbtree -N (commande inclue dans paquet smbclient) ainsi que par mon serveur mutimedia et probablement Windows

Je me souviens plus si c'était une histoire avec mon vieux serveur multimédia , mais peut être bien a cause de smbtree

Dernière modification par Croutons (20-10-2022 15:00:23)

Croutons · 22-10-2022 16:01:50

re

Lolo_D a écrit :

petite question, est-ce que cela pourrait venir du fait que l'utilisateur noté dans linux ne porte pas le même nom que celui sur le serveur linux ? idem pour linux client ?
je suis preneur d'une info complémentaire...d'une piste à chercher ! je vous remercie par avance,

alors non ceci ne pose pas de problème, tu peux te connecter a un un dossier partagé quelque soit le nom de ton utilisateur coté client, il te suffit de connaitre le login et le mot de passe requis pour acceder au partage
charlotte pourra par exemple se connecté a un partage qui était à la base exclusivement destiné a laurenttech si elle connait son login et son mot de passe
cela simplifie un peu les choses pour les droits, tu n'as pas besoin d'avoir autant d'utilisateur sur le serveur

valid users = laurenttech, charlotte, @tech

ses users doivent être ceux que tu as créer coté serveur ,(mot de passe defini avec smbpasswd -a nomdel'user)
pour afficher la liste des utilisateur Samba sur le serveur

pdbedit -L 

smb://192.168.31.200/srv/partagesmb/

normalement devrait fonctionné aussi avec le hostname du serveur à la place de l'ip

hostname

verifi coté serveur que c'est bien son adresse

ip addr

[partage]
comment = Partage de données
path = /srv/partagesmb
guest ok = no
read only = no
browseable = yes
valid users = laurenttech, charlotte, @tech
create mask = 0660
directory mask = 0770
force groupe = grppartage

se serait pas plutot

force groupe = +tech

vu la
https://wiki.archlinux.org/title/Samba# … ermissions
toujours vérifier la syntaxe du smb.conf après modification

testparm

Dernière modification par Croutons (22-10-2022 16:30:18)

Lolo_D · 28-10-2022 09:33:45

Woooo merci pour ce retour hyper complet ! j'ai beaucoup de boulot à reprendre ! merci en tout cas, je vais essayer tout ça et prendre le temps de lire calmement (#survolté)
J'ai des choses à tester et des impératifs familiaux... je reviens vers vous, sans faute mercredi ou jeudi dans le courant de la semaine prochaine avec un résultat disant "problème résolu" !

normalement pour windows, j'avais check le pare-feu justement ^^' je commence à avoir des réflexes à force de me heurter aux murs ^^

Debian-facile

#1 07-10-2022 12:54:48

débutant sur samba

#2 14-10-2022 07:16:40

Re : débutant sur samba

#3 20-10-2022 08:01:38

Re : débutant sur samba

#4 20-10-2022 09:48:01

Re : débutant sur samba

#5 22-10-2022 16:01:50

Re : débutant sur samba

#6 28-10-2022 09:33:45

Re : débutant sur samba

Pied de page des forums