Private Samba

Private Samba
All Titles TV Episodes Celebs Companies Keywords Advanced Search
Fully supported English (United States) Partially supported Français (Canada) Français (France) Deutsch (Deutschland) हिंदी (भारत) Italiano (Italia) Português (Brasil) Español (España) Español (México)
Suggest an edit or add missing content
The Best Movies and Shows in September
We Love These Hollywood Power Couples

One of Samba's most complicated tasks lies in
reconciling the security models of Unix and Windows systems. Samba
must identify users by associating them with valid usernames and
groups, authenticate them by checking their passwords, then control
their access to resources by comparing their access rights to the
permissions on files and directories. These are complex topics on
their own, and it doesn't help that there are three
different operating system types to deal with (Unix, Windows
95/98/Me, and Windows NT/2000/XP) and that Samba supports multiple
methods of handling user authentication.
The valid users option lists
the users allowed to access the share. In this case, only the user
dave is allowed to access the share. In some
situations it is possible to specify that any user can access a disk
share by using the guest ok
parameter. Because we don't wish to allow guest
access, that option is absent here. If you allow both authenticated
users and guest users access to the same share, you can make some
files accessible to guest users by assigning world-readable
permissions to those files while restricting access to other files to
particular users or groups.
When client users access a Samba share, they have to pass two levels
of restriction. Unix permissions on files and directories apply as
usual, and configuration parameters specified in the Samba
configuration file apply as well. In other words, a client must first
pass Samba's security mechanisms (e.g.,
authenticating with a valid username and password, passing the check
for the valid users parameter
and the read only parameter,
etc.), as well as the normal Unix file and directory permissions of
its Unix-side user, before it can gain read/write access to a share.
In addition, you need to create a shared directory that the members
of the group can access and point to it with the
path configuration option. Here are the Unix
commands that create the shared directory for the accounting
department (assuming /home/samba already
exists):
The [homes] share is a special section of the
Samba configuration file. If a user attempts to connect to an
ordinary share that doesn't appear in the
smb.conf file (such as specifying it with a UNC
in Windows Explorer), Samba will search for a
[homes] share. If one exists, the incoming share
name is assumed to be a username and is queried as such in the
password database ( /etc/passwd or equivalent)
file of the Samba server. If it appears, Samba assumes the client is
a Unix user trying to connect to his home directory.
As an illustration, let's assume that
sofia is attempting to connect to a share called
[sofia] on the Samba server. There is no share by
that name in the configuration file, but a [homes]
share exists and user sofia is present in the
password database, so Samba takes the following steps:
Samba creates a new disk share called [sofia] with
the path specified in the
[homes] section. If no path
option is specified in [homes] , Samba initializes
it to her home directory.
Samba initializes the new share's options from the
defaults in [globals] , as well as any overriding
options in [homes] with the exception of
browsable .
Samba connects sofia 's client to
that share.
The invalid users option, like
valid users , can take group
names, preceded by an at sign ( @ ), as well as
usernames. In the event that a user or group appears in both lists,
the invalid users option takes
precedence, and the user or group is denied access to the share.
This option takes both group names and usernames. In addition, you
can specify NIS netgroups by preceding them with an
@ as well; if the netgroup is not found, Samba
will assume that you are referring to a standard Unix group.
Be careful if you assign administrative privileges to a share for an
entire group. The Samba Team highly recommends you avoid using this
option, as it essentially gives root access to the specified users or
groups for that share.
If you wish to restrict access in a share only to guests—in
other words, all clients connect as the guest account when accessing
the share—you can use the guest
only option in conjunction with the
guest ok option, as shown in
the following example:
Make sure you specify yes for both
guest only and
guest ok ; otherwise, Samba will
not use the guest account that you specify.
Users who can perform operations as root
Users who will be denied access to a share
Users who have read-only access to a writable share
Users who have read/write access to a read-only share
Maximum number of connections for a share at a given time
Unix account that will be used for guest access
This option specifies a list of users that perform file operations as
if they were root . This means that they can modify
or destroy any other user's files, regardless of the
permissions. Any files that they create will have root ownership and
will use the default group of the admin user. The
admin users option allows PC
users to act as administrators for particular shares. Be very careful
when using this option, and make sure good password and other
security policies are in place.
These two options let you enumerate the users and groups who are
granted or denied access to a particular share. You can enter a list
of user and/or group names. If a name is prefixed by an at sign
( @ ), it is interpreted as a group name—with
NIS groups searched before Unix groups. If the name is prefixed by a
plus sign ( + ), it is interpreted as the name of a
Unix group, and NIS is not searched. If the name is prefixed by an
ampersand ( & ), it is interpreted as an NIS
group name rather than as a Unix group name. The plus sign and
ampersand can be used together to specify whether NIS or Unix groups
are searched first. For example:
In the valid users parameter,
users mary , ellen , and
sue are allowed access to the
[database] share, as are the members of the Unix
group marketing and NIS/Unix group
dbadmin . The invalid
users parameter denies access to the share by
users gavin , syd , and
dana , as well as members of the NIS group
techies and Unix/NIS group
helpdesk . In this last case, the list of Unix
groups is searched first for the helpdesk group,
and if it is not found there, the list of NIS groups is searched.
The important rule to remember with these options is that any name or
group in the invalid users list
will always be denied access, even if it is
included (in any form) in the valid
users list.
Like the valid users
and invalid
users options, this pair of options specifies
which users have read-only access to a writable share and read/write
access to a read-only share, respectively. The value of either
options is a list of users. The read
list parameter overrides any other Samba
permissions granted—as well as Unix file permissions on the
server system—to deny users write access.
The write
list parameter overrides other Samba permissions
to grant write access, but cannot grant write access if the user
lacks write permissions for the file on the Unix system. You can
specify NIS or Unix group names by prefixing the name with an at sign
(such as @users ). Neither configuration option has
a default value associated with it.
This option specifies the maximum number of client connections that a
share can have at any given time. Any connections that are attempted
after the maximum is reached will be rejected. The default value is
0 , which is a special case that allows an
unlimited number of connections. You can override it per share as
follows:
This option is useful in the event that you need to limit the number
of users who are accessing a licensed program or piece of data
concurrently.
This share-level option (also called only
guest ) forces a connection to a share to be
performed with the user specified by the guest
account option. The share to which this is applied
must explicitly specify guest
ok = yes for
this option to be recognized by Samba. The default value for this
option is no .
Table 9-2 shows two additional options that Samba
can use to correct for incompatibilities in usernames between Windows
and Unix.
Sets the name of the username mapping file
Indicates the number of capital letters to use when trying to match a
username
You can specify this option as follows:
Each entry in the username map file should be listed as follows: the
Unix username, followed by an equal sign ( = ),
followed by one or more whitespace-separated SMB client usernames.
Note that unless instructed otherwise (i.e., a guest connection),
Samba will expect both the client and the server user to have the
same password. You can also map NT groups to one or more specific
Unix groups using the @ sign. Here are some
examples:
You can also use the asterisk to specify a wildcard that matches any
free-form client username as an entry in the username map file:
Comments can be placed in the file by starting the line with a hash
mark ( # ) or a semicolon ( ; ).
Note that you can also use this file to redirect one Unix user to
another user. Be careful, though, as Samba and your client might not
notify the user that the mapping has been made and Samba might be
expecting a different password.
SMB clients (such as Windows) will often send usernames in SMB
connection requests entirely in capital letters; in other words,
client usernames are not necessarily case-sensitive. On a Unix
server, however, usernames are case-sensitive:
the user ANDY is different from the user
andy . By default, Samba attacks this problem by
doing the following:
Checking for a user account with the exact name sent by the client
Testing the username in all lowercase letters
Testing the username in lowercase letters with only the first letter
capitalized
If you wish to have Samba attempt more combinations of upper- and
lowercase letters, you can use the username
level global configuration option. This option
takes an integer value that specifies how many letters in the
username should be capitalized when attempting to connect to a share.
You can specify this option as follows:
In this case, Samba attempts all possible permutations of usernames
having three capital letters. The larger the number, the more
computations Samba has to perform to match the username, and the
longer the authentication will take.
Each share in the workgroup has one or more passwords associated with
it. Anyone who knows a valid password for the share can access it.
Each share in the workgroup is configured to allow access from
certain users. With each initial tree connection, the Samba server
verifies users and their passwords to allow them access to the share.
This is the same as user-level security, except that the Samba server
uses another server to validate users and their passwords before
granting access to the share.
Samba becomes a member of a Windows NT domain and uses one of the
domain's domain controllers—either the PDC or
a BDC—to perform authentication. Once authenticated, the user
is given a special token that allows her access to any share with
appropriate access rights. With this token, the domain controller
will not have to revalidate the user's password each
time she attempts to access another share within the domain. The
domain controller can be a Windows NT/2000 PDC or BDC, or Samba
acting as a Windows NT PDC.
Indicates the type of security that the Samba server will use
With share-level security, each share has one or more passwords
associated with it, with the client being authenticated when first
connecting to the share. This differs from the other modes of
security in that there are no restrictions as to whom can access a
share, as long as that individual knows the correct password. Shares
often have multiple passwords. For example, one password might grant
read-only access, while another might grant read/write access.
Security is maintained as long as unauthorized users do not discover
the password for a share to which they shouldn't
have access.
Next, right-click a resource—such as a hard drive or a
CD-ROM—and select the Properties menu item. This will bring up
the Resource Properties dialog box. Select the Sharing tab at the top
of the dialog box, and enable the resource as Shared As. From here,
you can configure how the shared resource will appear to individual
users, as well as assign whether the resource will appear as
read-only, read/write, or a mix, depending on the password that is
supplied.
You might be thinking that this security model is not a good fit for
Samba—and you would be right. In fact, if you set the
security =
share option in the Samba configuration file,
Samba will still reuse the username/password combinations in the
system password files to authenticate access. More precisely, Samba
will take the following steps when a client requests a connection
using share-level security:
When a connection is requested, Samba will accept the password and
(if sent) the username of the client.
If the share is guest only ,
the user is immediately granted access to the share with the rights
of the user specified by the guest
account parameter; no password checking is
performed.
For other shares, Samba appends the username to a list of users who
are allowed access to the share. It then attempts to validate the
password given in association with that username. If successful,
Samba grants the user access to the share with the rights assigned to
that user. The user will not need to authenticate again unless a
revalidate =
yes option has been set inside the share.
If the authentication is unsuccessful, Samba attempts to validate the
password against the list of users previously compiled during
attempted connections, as well as those specified under the share in
the configuration file. If the password matches that of any username
(as specified in the system password file, typically
/etc/passwd ), the user is granted access to the
share under that username.
However, if the share has a guest
ok or public option set, the
user will default to access with the rights of the user specified by
the guest account option.
You can indicate in the configuration file which users should be
initially placed on the share-level security user list by using the
username configuration option, as shown here:
Here, when a user attempts to connect to a share, Samba verifies the
sent password against each user in its own list, in addition to the
passwords of users davecb ,
pkelly , and andyo . If any of
the passwords match, the connection is verified, and the user is
allowed. Otherwise, connection to the specific share will fail.
Table 9-4 shows the options typically associated
with share-level
security .
If yes , usernames specified by
username are the only ones allowed
Users against which a client's password is tested
This Boolean option indicates whether Samba will allow connections to
a share using share-level security based solely on the individuals
specified in the username option, instead of those
users compiled on Samba's internal list. The default
value for this option is no . You can override it
per share as follows:
This option presents a list of usernames and/or group names against
which Samba tests a connection password to allow access. It is
typically used with clients that have share-level security to allow
connections to a particular service based solely on a qualifying
password—in this case, one that matches a password set up for a
specific user:
You can enter a list of usernames and/or group names. If a name is
prefixed by an at sign ( @ ), it is interpreted as a
group name, with NIS groups searched before Unix groups. If the name
is prefixed by a plus sign ( + ), it is interpreted
as the name of a Unix group, and NIS is not searched. If the name is
prefixed by an ampersand ( & ), it is
interpreted as an NIS group name rather than a Unix group name. The
plus sign and ampersand can be used together to specify whether NIS
or Unix groups are searched first. When Samba encounters a group name
in this option, it attempts to authenticate each user in the group
until if finds one that succeeds. Beware that this can be very
inefficient.
We recommend against using this option unless you are implementing a
Samba server with share-level security.
Each user listed can connect to the share if the password provided
matches the password stored in the system password database on the
server. Once the initial authentication succeeds, the client will not
need to supply a password again to access that share unless the
revalidate =
yes option has been set.
Note that you can specify more than one machine as the target of the
password server ; Samba moves
down the list of servers in the event that its first choice is
unreachable. The servers identified by the
password server option are
given as NetBIOS names, not their DNS names or equivalent IP
addresses. Also, if any of the servers reject the given password, the
connection automatically fails—Samba will not attempt another
server.
One caveat: when using this option, you still need an account
representing that user on the regular Samba server. This is because
the Unix operating system needs a username to perform various I/O
operations. The preferable method of handling this is to give the
user an account on the Samba server but disable the
account's password by replacing it in the system
password file (e.g., /etc/passwd ) with an
asterisk (*).
With domain-level
security , the Samba server acts as a member of
a Windows domain. Recall from Chapter 1 that each
domain has a primary domain controller, which can be a Windows
NT/2000 or Samba server offering password authentication. The domain
controller keeps track of users and passwords in its own database and
authenticates each user when she first logs on and wishes to access
another machine's shares.
As mentioned earlier in this chapter, Samba has a similar ability to
offer user-level security, but that option is Unix-centric and
assumes that the authentication occurs via Unix password files. If
the Unix machine is part of an NIS or NIS+ domain, Samba
authenticates users transparently against a shared password file in
typical Unix fashion. Samba then provides access to the NIS or NIS+
domain from Windows. There is, of course, no relationship between the
NIS concept of a domain and a Windows NT domain.
Configuring Samba for domain-level security is covered in Chapter 4 in Section 4.7 .
Three different encryption methods are used. Windows 95/98/Me clients
use a method inherited from Microsoft's LAN Manager
network software. Windows NT/2000/XP systems use a newer system,
called NT LAN Manager, or NTLM. A newer version of this (called NT
LAN Manager Version 2, or NTLMv2) uses a different method for
password hashing.
If encrypted passwords are supported, Samba stores the encrypted
passwords in a file called smbpasswd . By
default, this file is located in the private
directory of the Samba distribution (typically
/usr/local/samba/private ). At the same time, the
client stores an encrypted version of a user's
password on
Little Nasty
Ava Naked
Public Pickups Nina Euro Babe Porn

Private Samba

Report Page