Samba 企业应用案例

逃离我推掉我的手 2022-06-04 06:28 189阅读 0赞

Samba 企业应用案例需求:
    1. 所有员工都能够在公司内流动办公,但不管在哪电脑上工作,都要把自己文件存
    在 Samba 文件服器上.
    2. 各部门办公人员拥有各自的主目录,用于存放私有文档(工作相关),其他人禁
    止访问.
    3. 所有的用户都不允许使用服务器的 SHELL(安全考虑).
    4. 制造部、财务部、管理部,都有各自的文件目录.
    5. 各部门目录下提供“对外”、“公共文档”、“受控文档”三个子目录.
    
    对外: 
    <1>允许公司所有工作人员访问,但不能修改文件.
    <2>本部门文员负责维护数据
    
    公共文档:
    <1>本部门员工可以访问,领导层可以访问,但不能修改.
    <2> 本部门文员负责维护数据
    
    受控文档:
    <1>本部门主管、公司领导可以访问、其他员工禁止.
    <2>本部门主管负责维护数据
    注:财务部受控文档只允许总经理、财务部总监、主管访问;管理部受控文档只
    允许总经理、主管访问
    
    6. 公共区域:
    <1>所有员工均可访问 
    <2>网络部负责维护  
    
    7. 交换区域:
    <1>所有员工均可读可写,禁止删除其它员工文件.
    2>网络部负责维护

**分析此题：**  
**1)创建用户（所有的用户都不允许使用服务器的 SHELL(安全考虑)）**  
**wy（文员） jl（总经理） zj（财务部总监） zg（主管）**  
**-s /bin/false**

useradd s /bin/false wy zg zj jl

**2)建立组，这里一共分为五个组：**  
**caiwu guanli zhizao network lingdao**

groupadd zhizao caiwu guanli lingdao network
    usermod -G zhizao,caiwu,guanli wy
    usermod -G zhizao,caiwu,guanli zg
    usermod -G caiwu zj
    usermod -G lingdao jl

**3)建立部门，这里一共五个部门：**  
**caiwu guanli zhizao public swap**  
**为这五个组分别建立主目录以及他们自己的子目录**

mdkir /home/samba/zhizao caiwu guanli public swap
    mkdir /home/samba/zhizao/guest public private
    mkdir /home/samba/caiwu/guest public private
    mkdir /home/samba/guanli/guest public private

**5)给public和swap目录加权限：**

chmod 755 /home/samba/zhizao
    chmod 1777 /home/samba/swap
    chmod 775 /home/samba/public
    chgrp network /home/samba/public

**6)给zhizao部门的目录及子目录设定权限**

chmod 755 /home/samba/zhizao/guest
    chown wy.zhizao /home/samba/zhizao/guest
    chmod 750 /home/samba/zhizao/private
    chown zg.lingdao /home/samba/zhizao/private
    chmod 750 /home/samba/zhizao/public
    chown wy.zhizao /home/samba/zhizao/public
    setfacl -m g:lingdao:rx /home/samba/zhizao/public

**7)给caiwu部门的目录及子目录设定权限**

chmod 755 /home/samba/caiwu/guest
    chown wy.caiwu /home/samba/caiwu/guest/guest
    chmod 750 /home/samba/caiwu/public
    chown wy.caiwu /home/samba/caiwu/public
    setfacl -m g:lingdao:rx /home/samba/caiwu/public
    chmod 700 /home/samba/caiwu/private
    chown zg /home/samba/caiwu/private
    setfacl -m u:zj:rx /home/samba/caiwu/private
    setfacl -m u:jl:rx /home/samba/caiwu/private

**8)给guanli部门的目录及子目录设定权限**

chmod 755 /home/samba/guanli/guest
    chown wy.guanli /home/samba/guanli/guest
    chmod 750 /home/samba/guanli/public
    chown wy.guanli /home/samba/guanli/public
    setfacl -m g:lingdao:rx /home/samba/guanli/public
    chmod 700 /home/samba/guanli/private
    chown zg /home/samba/guanli/private
    setfacl -m u:jl:rx /home/samba/guanli/private

**9) 配置 samba 服务: /etc/samba/smb.conf**

[homes]
       comment = Home Directories
       browseable = no
       writable = yes
    [制造部]
    path = /home/samba/zhizao
    writable = yes
    browseable = yes
    [对外]
    path = /home/samba/zhizao/guest
    admin users = wy
    browseable = no
    [公共文档]
    path = /home/samba/zhizao/public
    valid users = @zhizao @lingdao
    admin users = wy
    browseable = no
    [受控文档]
    path = /home/samba/zhizao/private
    valid users = zg @lingdao
    admin users = zg
    browseable = no
    [财务部]
    path = /home/samba/caiwu
    writable = yes
    browseable = yes
    [对外]
    path = /home/samba/caiwu/guest
    admin users = wy
    browseable = no
    [公共文档]
    path = /home/samba/caiwu/public
    valid users = @caiwu @lingdao
    admin users = wy
    browseable = no
    [受控文档]
    path = /home/samba/caiwu/private
    valid users = zg zj jl
    admin users = zg
    browseable = no
    [管理部]
    path = /home/samba/guanli
    writable = yes
    browseable = yes
    [对外]
    path = /home/samba/guanli/guest
    admin users = wy
    browseable = no
    [公共文档]
    path = /home/samba/guanli/public
    valid users = @guanli @lingdao
    admin users = wy
    browseable = no
    [受控文档]
    path = /home/samba/guanli/private
    valid users = zg jl
    admin users = zg
    browseable = no
    [公共区域]
    path = /home/samba/public
    public = yes
    admin users = @network
    [交换区域]
    path = /home/samba/swap
    writeable = yes
    public = yes
    admin users = @network

**部分截图：**  
![这里写图片描述][SouthEast]

![这里写图片描述][SouthEast 1]

![这里写图片描述][SouthEast 2]

![这里写图片描述][SouthEast 3]

[SouthEast]: /images/20220604/c92536ded5294d468d935aa832edeea1.png
[SouthEast 1]: /images/20220604/02ef138f02e3455595a80662eddeca7f.png
[SouthEast 2]: /images/20220604/0d13d47b9dc04b14b213398cc1b63e50.png
[SouthEast 3]: /images/20220604/c0b8b59014ab4f299cf677ef2f45f844.png