https://wiki.samba.org/index.php/Samba_AD_DC_Port_Usage

安装后开放端口

1    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:445
2    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:139

发现samba可以连接,但没有显示文件列表.

于是google,发现需要设置selinux。

http://danwalsh.livejournal.com/14195.html

setenforce 0 先关闭selinux看是否正常访问,若正常,则是selinux的问题,再开启selinux,设置:

允许home目录共享:

setsebool -P samba_enable_home_dirs 1

特定目录,未测试:

chcon -R -t samba_share_t /var/eng  


Reference:

Confining Samba with SELinux
November 9th, 2007
My next few blogs will be taking different confined domains and writing about the types and booleans related to that domain, I will be updating the man pages for these confined domains.  And then showing how the policy for the domain works.

samba has had a man page available for some time named samba_selinux, here is my rewrite for Fedora 7/8

> man samba_selinux

samba_selinux(8)      Samba Selinux Policy documentation      samba_selinux(8)

NAME
       samba_selinux - Securing Samba with SELinux

DESCRIPTION
      
Security-Enhanced  Linux  secures  the Samba server via flexible
mandatory access control.  SELinux Samba policy defaults to least
privilege access.  Several Booleans and file contexts are available to
customize the way Samba SELinux works.

SHARING FILES
      
SELinux requires files be labeled with an extended attribute to define
the file type.  Policy governs the access daemons have to these files.
When sharing files with Samba you have many options  on  how  to label
the files.  If you want to share files/directories other than home
directories or standard directory.  You should label these
files/directories as samba_share_t.  For example if you created the
directory /var/eng, you can label the directory and its contents with
the chcon tool.

# chcon -R -t samba_share_t /var/eng

This label will not survive a relabel.  A better solution to make the
change permanent, you must tell the SELinux system about the label
customization.  The semanage command can customize the  default  file
contexts on your machine. restorecon will read the file_context and
apply it to the files and directories..

# semanage fcontext -a -t samba_share_t ’/var/eng(/.*)?’
       # restorecon -R -v /var/eng

SHARING HOME DIRECTORIES
      
By  default  SELinux  policy  turns  off  SELinux  sharing  of  home 
directories  If  you  are  setting  up  this  machine  as  a  Samba 
server  and wish to share the home directories, you need to set the 
      samba_enable_home_dirs boolean.

# setsebool -P samba_enable_home_dirs 1

SHARING PUBLIC FILES
      
If you want to share files with multiple domains (Apache, FTP, rsync,
Samba), you can set a file context of public_content_t and
public_content_rw_t.  These context allow any of the above  domains  to 
read
       the content.  If you want a particular domain to write
to the public_content_rw_t domain, you must set the appropriate
boolean.  allow_DOMAIN_anon_write.  So for samba you would execute:

# semanage fcontext -a -t public_content_rw_t ’/var/eng(/.*)?’
       # restorecon -R -v /var/eng
       # setsebool -P allow_smbd_anon_write 1

SHARING FILES SYSTEM FILES
      
Note:  You  should  not  do  the above for standard directories or home
directories!  For example directories owned by an RPM.  If you wanted
to share /usr via Samba, changing its context and all of the sub
directories  to samba_share_t would be a bad idea.  Other confined
domains would no longer be able to read /usr and this would cause havoc
on the machine.  There are two booleans that you can set  to  allow the
sharing of standard directories.  If you want to share any standard
directory read/only you can set the boolean samba_export_all_ro.

# setsebool -P samba_export_all_ro 1

This boolean will allow Samba to read every file on the
system.Similarly if you want to share all files and directories via
Samba, you set the samba_export_all_rw

# setsebool -P samba_export_all_rw 1

This boolean would allow Samba to read and write every file on your
system.  So a compromised Samba server would be very dangerous.

SHARING PUBLIC NFS FILES
      
SELinux prevents the Samba daemons from reading/writing nfs shares by
default.  If you are using samba to share NFS file systems you need to
turn on the samba_share_nfs boolean

# setsebool -P samba_share_nfs 1

USING CIFS/SAMBA HOME DIRECTORIES
      
Samba  SELinux  policy will not allow any confined applications to
access remote samba shares mounted on your machine.  If you want to use a
remote Samba server for the home directories on this machine, you must
set the use_samba_home_dirs boolean.

# setsebool -P use_samba_home_dirs 1

SAMBA Scripts
      
Samba can be setup to run user defined scripts, by default if you
install these scripts /var/lib/samba/scripts they will be labeled
samba_unconfined_script_exec_t.  Since these scripts  can  do  just 
about  anything on the system you can run them as unconfined.  But you
need to turn on the samba_run_unconfined boolean

# setsebool -P samba_run_unconfined 1

If  you  are  willing  to  write  policy  an  interface  exists  in 
samba.if  called  samba_helper_template(APP).   This  interface  will 
create  a file context of samba_APP_script_exec_t, and a domain of
samba_APP_script_t. Samba will transition scripts labeled
samba_app_script_exec_t to samba_APP_script_t, you can then user
audit2allow to write policy to confine your script.

USING SAMBA AS A DOMAIN CONTROLLER
      
If you want to run samba as a domain controller, IE Add machines to the
passwd file on a Linux box, you need to turn on the
samba_domain_controller boolean.  This allows the Samba daemon to run
and  transition to the passwd, useradd, and groupadd utilities.  These
tools can manipulate the passwd database.

GUI system-config-selinux
       system-config-selinux is a GUI tool available to customize all of the SELinux booleans and file context described above.

AUTHOR
       This manual page was written by Dan Walsh <dwalsh@redhat.com>.

SEE ALSO
       selinux(8), semanage(8), samba(7), chcon(1), setsebool(8), restorecon(8),

dwalsh@redhat.com                 9 Nov 2007                  samba_selinux(8)

Samba配置的更多相关文章

  1. debian下samba配置

    debian下samba配置  http://blog.chinaunix.net/uid-2282111-id-2113216.html 服务器端配置过程:1. apt-get install sa ...

  2. samba配置中常见错误收集.txt

    在命令行输入命令: ~$ smbclient -L \\127.0.0.1按要求输入密码后,提示出错:session setup failed: NT_STATUS_LOGON_FAILURE 这是因 ...

  3. centos samba/squid 配置 samba配置 smbclient mount fstab自动挂载samba curl -xlocalhost:3128 www.qq.com squid配置 3128 DNSPOD 第二十七节课

    centos  samba/squid 配置  samba配置 smbclient  mount fstab自动挂载samba curl -xlocalhost:3128 www.qq.com squ ...

  4. 通过视频展示如何通过Samba配置PDC

    通过视频展示如何通过Samba配置PDC(Linux企业应用案例精解补充视频内容) 本文通过视频,真实地再现了在Linux平台下如何通过配置smb.conf文件而实现Samba Server模拟win ...

  5. Centos7 samba配置

    目录 免密码只读 加密码可读写 Samba配置了很多次,总是忘,现在写在博客里. 免密码只读 最主要的是免密配置,主要用到了两个配置,要写在[global]里: map to guest = Bad ...

  6. samba 配置参数详解

    samba 配置参数详解: 一.全局配置参数  workgroup = WORKGROUP说明:设定 Samba Server 所要加入的工作组或者域. server string = Samba S ...

  7. 新建samba配置步骤

    Linux系统默认已经安装了Samba,但是没有安装Samba服务: 1,先查看安装情况:rpm -qa|grep samba 根据系统的安装情况选择下载或者通过光驱安装所缺的rpm包. 我的安装情况 ...

  8. (转)Ubuntu samba配置服务文件包

    转:http://os.51cto.com/art/201001/176366.htm Ubuntu samba服务配置是很不错的文件应用很有学习价值,这里我主要讲解Ubuntu samba服务配置的 ...

  9. Linux samba配置

    更详细的配置地址:http://www.cnblogs.com/mchina/archive/2012/12/18/2816717.html 1 安装  yum -y install samba 2 ...

  10. samba配置只读共享

    编辑smb.conf 1.在[global]中 找到 security = 将其改为 security = share 2. 在文件中加入自定义的共享目录 [attachment] path=/dat ...

随机推荐

  1. mysql 如何判断 "字符串" 是否为 "数字"

    这个问题有点怪 ,但很多时候我们会以字符串的形式存储数字 , 反过来我们用字符串进行数学运算时, 好像也不会出错 . 除非 , 用作数学运算的字符串不能转换成数字 .但是我们改如何判断字符串是否能转换 ...

  2. git的合并与推送

    集中式合作模式 1.git fetch 获取远程更新 2.git merge origin/master 进行合并,如果报错,则相应解决.注:你得用git bash命令行执行才能看见报错详情,用ecl ...

  3. 向Web开发人员推荐12款优秀的 Twitter Bootstrap 组件和工具

    http://www.cnblogs.com/lhb25/archive/2012/09/11/resources-that-complement-twitter-bootstrap.html

  4. struts1 核心类

    http://ajh-123.blog.163.com/blog/static/161727409201031455634475/ 1.ActionServlet类: 是一个前端控制器,将reques ...

  5. 阴影:box-shaw

    box-shaw:0px 0px 2px 3px while; 水平方向  垂直方向  模糊半径  模糊系数(大小)颜色

  6. ios retain 与 copy 的区别

    .retain 与copy区别 retain 的仅仅是引用计数加1,但是并没有创建新的对象.它们的指针是指向相同的内存地址. copy 是创建一个新的对象作为原来对象的副本,新创建出来的引用计数并没有 ...

  7. C#中常用的与编码有关的代码

    如何将字符串转化为字符数组? char[] chars=str.ToArray(); 如何将字符串转化为字节数组? Encoding.ASCII.GetBytes(str); Encoding.Uni ...

  8. 获取UILabel宽度的方法

    - (CGFloat)labelLength:(NSString *)str font:(CGFloat)font{ str = ISSTRING(str) ? str : @"" ...

  9. CF 706B 简单二分,水

    1.CF 706B  Interesting drink 2.链接:http://codeforces.com/problemset/problem/706/B 3.总结:二分 题意:给出n个数,再给 ...

  10. GX转账站点无法访问的问题

    1.先检查200路由器上的端口<8099,8098> 没有则加上 2.检查站点是否能在200服务器上打开 不能打开,重启站点