how to access samba file share from windows server 2019

 Ref: www.alibabacloud.com

After edit not restart Server

Solution

1. On an on-premises Windows client, press Win+R to open the Run dialog box. In the Run dialog box, enter gpedit.msc in the Open field, and then click OK.

2. In the left-side navigation pane of the Local Group Policy Editor dialog box, choose Computer Configuration > Administrative templates > Network > Lanman Workstation.

3. In the Setting section of the Lanman Workstation page, click Enable insecure guest logons.

4. In the Enable insecure guest logons dialog box, select Enabled. Click Apply.

5. Mount the SMB share.

6. If you still fail to mount the SMB share, restart the Windows client to clean up the cache and try again.

Edit share configure on Samba

Change follow the Red highlight 

-------------------------------------------//

[Downloads]

   comment = Triple X

   path = /home/user/Downloads

   guest ok = yes

   read only = no

   writeable = yes

   browseable = yes

   create mask = 0775

   directory mask = 0775

   valid users = user, nobody

//--------------------------------------------

Allow user nobody only Write on folder Software

$ history | grep nobody

id nobody

chown +g nobody Downloads/Software/

chown nobody -R Downloads/Software/

sudo chown nobody -R Downloads/Software/

configure samba for centos 7

#yum install samba samba-client samba-common


vim /etc/samb/smb.conf

-------------------------------------------Start-----------------------------------------------------
[global]
        workgroup = ARSSYSTEM
        server string = ARS Data Center System
        security = user
        netbios name = ARSDC08

        browseable = No
;       passdb backend = tdbsam
        passdb backend = smbpasswd

        printing = cups
        printcap name = cups
        load printers = no
        cups options = raw
        disable spoolss = yes
        load printers = no
        printing = bsd
        printcap name = /dev/null
        disable spoolss = yes

        veto files = /*.mp3*/            #Protect file mp3

        log file = /var/log/samba/%m.log
        log level = 3
        debug timestamp = yes
        host msdfs = no
        ntlm auth = yes                   # For user windows xp access

-------------------------------------------//End//---------------------------------------------------

การปรับสิทธิ์ให้ผู้ใช้งาน 2 กลุ่ม เช่น user01 อยู่ในกลุ่ม user, tech สามารถสร้างและให้คนที่อยู่ในกลุ่มอื่นแก้ไขไฟล์ได้พร้อมกัน โดยการบังคับให้เวลาสร้าง Folder, File, อยู่ในกลุ่ม tech แทนกลุ่ม user

[tech]
        comment = Tech department only
        inherit acls = Yes
        path = /mnt/tech
        guest ok = no
        browseable = yes
        write list = @techAdmin   #only the group that has write privileges
        valid users = @tech
        force group = tech            #this is so that all files written to the share will be set to "chgrp tech" if you dont do this only the user that created the file will have access to it.
        create mask = 0775            #this forces all created documents to have 775 perms (WR-WR-WR)
        directory mask = 0775       #same for directories

วิธีแก้ไขปัญหา Windows xp เข้าใช้งาน share file samba ไม่ได้

ให้เพิ่ม configure /etc/samba/smb.conf

ntlm auth = yes


Ref: samba

Disable selinux on Centos 7 and set firewall-cmd

CentOS7

1.check status selinux enable or disable

#sestatus

#vim /etc/sysconfig/selinux

SELINUX=disabled

and Reboot system

ถ้าปิด Selinux ผิดจะขึ้น Error แบบนี้ : failed to load selinux policy freezing

วิธีแก้ไข

ในหน้าบู๊ด ให้กด e แล้วมองหา linux16 แล้วเพิ่ม selinux=0 เข้าไป แล้ว ctrl+x เพื่อเข้าสู่ระบบ จากนั้นไปแก้ไขค่า

SELINUX=disabled ตามข้อมูลด้านบน

Go to the main command (usually starting with “linux16” or something similar) and add “selinux=0” as one of the parameters:

Ref: selinux policy freezing

Ref: disable-selinux-temporarily-permanently-in-centos-rhel-fedora/

2. Enable / Disable service
- SAMBA

systemctl enable smb.service
systemctl enable nmb.service
systemctl restart smb.service
systemctl restart nmb.service

Restatr/Reload service
systemctl reload smb.service
systemctl restart smb.service

Check service runnig
systemctl list-unit-files
chkconfig --list |grep ชื่อของ service
systemctl
systemctl | more
systemctl | grep httpd
systemctl list-units --type service
systemctl list-units --type service |grep ชื่อของ service
systemctl list-units --type mount
  
example:
systemctl | grep smartd

View service running
systemd-cgtop


- IPTABLES
systemctl stop firewalld
systemctl mask firewalld
yum install iptables-services
systemctl enable iptables
systemctl start iptablesmkdir
service iptables save

- iptables command
-A RH-Firewall-1-INPUT -p udp -m udp --dport 137 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 138 -j ACCEPT-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT

Check filrewall running ?
firewall-cmd --state systemctl status firewalldSet firewalld
List service on zone public

firewall-cmd --zone=public --list-all

List only port
firewall-cmd --list-ports


Add service

# firewall-cmd --zone=public --permanent --add-service=samba
# firewall-cmd --zone=public --permanent --add-service=http
# firewall-cmd --reload

Remove service

#firewall-cmd --zone=public --remove-service=http

Add Port

firewall-cmd --zone=public --permanent --add-port=10000/tcp
firewall-cmd --zone=public --permanent --add-port=2500-2600/tcp


Delete port
firewall-cmd --remove-port=6161/tcp
firewall-cmd --zone=public --permanent --remove-port=10000/tcp
firewall-cmd --zone=public --permanent --remove-port=2500-2600/tcp

Save firewall
firewall-cmd --runtime-to-permanent

firewall-cmd --reload

firewall-cmd --get-services 

Ref: https://www.centos.org/forums/viewtopic.php?t=61108
Ref: quick-docs firewalld
Ref: firewall-cmd config

How to protect samba from WannaCry (Sambacry)

1. Allow & Block Network

hosts deny = ALL
​hosts allow = 192.168.1.

2. Add buttom line
server min protocol = SMB2_10
​client max protocol = SMB3
​client min protocol = SMB2_10

sudo systemctl restart smbd

Ref:
http://www.techrepublic.com/article/how-to-protect-samba-from-the-likes-of-the-sambacry-exploit

Configure Samba

#cp /etc/samba/smb.conf /etc/samba/smb.conf.bak
#vi /etc/samba/smb.conf

[global]
workgroup = workgroup
server string = Kubuntu Server
hosts allow = 192.168.0. 192.168.10. 127.
security = user
load printers = yes
;guest account = nobody
log file = /var/log/samba.%m
max log size = 50
encrypt passwords = true
null passwords = no
local master = yes
os level = 33
;domain master = yes
;preferred master = yes
;domain logons = yes
;logon script = %G.bat


#============================ Share Definitions ==============================
[programe]
comment = programe
path = /media/hda9/programe
create mask =0640
directory mask = 750
valid users = @xisgo, hades
public = yes
writable = yes
[Music]
comment = music on hda5
path = /media/hda5/Download/programe/Music
available = yes
browseable = yes
public = yes
writable =yes
[programe2]
comment = programe2
path = /media/hda5/Download/programe
create mask =0640
directory mask = 750
valid users = @xisgo, hades
public = yes
writable = yes

#################################################
อย่าลืม #smbpasswd -a user เพื่อสร้าง user เข้าไปใช้งานด้วยล่ะครับ

นี้คือตัวอย่างการเซท Samba เพื่อใช้แชร์โฟล์เดอร์
Reference:
1. sontayamyblog

samba command line
Display current connection
$ smbstatus
Display more/detailed information: จำนวนผู้ใช้งานอยู่ ณ ตอนนี้
$ smbstatus -b
$ smbstatus -v |grep "Mon Jun 10 20:" แสดงผู้ใช้งานอยู่ ณ วันจันทร์ที่ 10 มิ.ย. เวลา 20:* 
$ smbstatus -v |grep "share-hr-gm" |grep "Jun 10 20:"
$ smbstatus --shares
$ smbstatus -s |grep "Mon Jun 10 20:"

Display verbose output:
$ smbstatus -v
$ smbstatus -v | grep user     display specific user 
Display only list of shares:
$ smbstatus -s

2. ยอมให้รันไฟล์ .exe เพื่อติดตั้งโปรแกรมได้จากเครื่อง Client โดยการเพิ่มบรรทัดด้านล่างเพิ่มเข้าไป
#--------------------------------update 20170214---------------------------------------------------#
[global]
workgroup = WORKGROUP
#server string = Samba Server %v
server string = %h server (Samba, Ubuntu)
netbios name = share-ubuntu
interfaces = 127.0.0.0/8 10.10.10.0/24 192.168.10.0/24
security = user
bind interfaces only = yes
map to guest = bad user
dns proxy = no
unix charset = UTF-8
log file = /var/log/samba/log.%m
max log size = 50000
passdb backend = tdbsam
obey pam restrictions = yes
unix password sync = yes
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
pam password change = yes
vfs objects = full_audit recycle
full_audit:prefix = %u|%I|%m|%S
full_audit:success = mkdir rename unlink rmdir pwrite
full_audit:failure = none
full_audit:facility = local7
full_audit:priority = NOTICE
########## Enable execute file .exe ##########
acl allow execute always = True

# Enable the recycle bin 
#vfs object = recycle 
recycle: repository = /myfolder /recycle /%U
recycle: touch = Yes
recycle: keeptree = Yes
recycle: versions = Yes
recycle: noversions = * tmp, * temp, * o, * obj, * TMP, TEMP *......
recycle: exclude = * tmp, * temp, * o, * obj, * TMP, TEMP *......
recycle: excludedir = /recycle, /tmp, /tmp, /tmp, /TEMP

#======================= Share Definitions =========================#
[Downloads]
path = /home/user/downloads
browsable =yes
writable = yes
guest ok = yes
read only = no
force user = nobody
create mask = 0777
directory mask = 0777

#--------------------------------------------------------------------------------------------------------#

Ref: execute a exe on a samba share