Khawulela ukwabelana kwe-Samba kumsebenzisi oyedwa nekheli elilodwa le-VPN

Kulesi sakhiwo, izimvume ezimbili ezihlukene ziyahlangana: ukuthi ubani angasebenzisa idrayivu, nokuthi yimaphi amakheli angaxhumeka nhlobo. Ukubhala uhlu lwama-akhawunti eceleni kohlu lwemithombo kubonakala njengokuhlanganisa, kodwa i-Samba ihlola zombili izinhlu njengezimo ezizimele. Noma ubani ohlangabezana nakho kokubili uyamukelwa, futhi lokho kuwumthetho obanzi kunalokho okuhloswe abaphathi abaningi. Isixazululo isakhiwo esihlukile sokwabelana noma isendlalelo senqubomgomo esingaveza ibhangqwana.

Inganekwane: izinhlu ezimbili zenza umthetho owodwa

Isithenjwa se-smb.conf sichaza i-valid users ne-hosts allow njengamapharamitha amabili angahlobene, futhi ukusetha kokubili ekwabelaneni okukodwa yilapho ukuvimbana kuqala khona. Setha i-valid users = mira, tomas ne-hosts allow = 10.77.0.21, 10.77.0.22 bese kwamukelwa izinhlanganisela ezine: uMira kunoma yiliphi ikheli, uTomas kunoma yiliphi ikheli. Akukho okubopha igama lokuqala ekhelini lokuqala kusakhiwo, futhi ukulandelana kwamagama akunamqondo. Ukuwahlela kabusha, ukwengeza umugqa wesibili we-hosts allow noma ukubeka igama elilodwa emugqeni ngamunye akushintshi lutho. Umphumela uwumkhiqizo wezinhlu ezimbili, hhayi umdwebo phakathi kwazo.

Lokho abantu abaningi abakufunayo ngempela kuwumkhawulo oqinile: uMira kuphela kuphela kukheli olulodwa, uTomas kuphela kolunye. Incazelo yokwabelana eyodwa ayinaso isakhiwo somusho salokho kubopha, futhi akukho kulandelana kobuhlakani okukudala. Lona uhlobo lwenqubomgomo i-Samba engayivezi ngaphakathi kokwabelana okukodwa, futhi yilapho inganekwane isaphila khona.

I-Samba ihlola ini, futhi ngaluphi ukulandelana

Izigaba zihamba ngokulandelana okungaguquki, futhi ukulandelana okungalungile kunika ukuxilongwa okungalungile. Iklayenti livula uxhumano; ukuhlolwa komnini womhlaba jikelele kuyasebenza uma kumisiwe; ukusethwa kwesikhathi kufakazela i-akhawunti; bese iklayenti lixhuma ekwabelaneni, lapho uhlu lwemikhosi yalokho kwabelana, i-valid users nesilungiselelo sokufunda kuphela kusetshenziswa khona; futhi kuphela lapho kuvulwa ifayela khona izimvume zohlelo lwamafayela zobunikazi obufakazelwe zinquma. Isigaba ngasinye singayenqaba ngokwaso isicelo, futhi ukweqa esisodwa akusho lutho ngesilandelayo. Umphumela obalulekile uwukuthi i-akhawunti isiyaziwa lapho kuhlolwa uhlu lwemikhosi yokwabelana, futhi uhlu lwemikhosi alunayo indlela yokuqamba leyo akhawunti.

Yingakho ukwabelana akukwazi ukubopha umsebenzisi oyedwa ekhelini elilodwa: i-hosts allow ne-valid users yizimo ezihlukene ezisetshenziswa esigabeni esifanayo sokuxhumeka kwesihlahla, futhi ngasinye siphendula umbuzo waso. Isimo somnini awilithathi igama le-akhawunti njengokufakwayo, ngakho asikwazi ukubhalwa ngomsebenzisi ngamunye. Ibhangqwana lingavezwa kuphela ukwabelana kwesibili noma isendlalelo senqubomgomo ngaphandle kwe-Samba.

Amanani omhlaba jikelele abalulekile ngenxa yendlela okugadlwayo ngayo. Ukwabelana okushiya i-hosts allow kugadla inani lomhlaba jikelele, futhi ukwabelana okusetha okwakho kusebenzisa lelo nani esikhundleni somhlaba jikelele, hhayi ngaphezu kwalo. Ngakho uhlu olubanzi lomhlaba jikelele lwandisa ukwabelana okungakasethi pharamitha, futhi akwenzi lutho ekwabelaneni okuchaza okwakho. Gijimisa i-testparm -s bese ufunda amanani okwabelana ngakunye ekuphrintayo, ngoba lokho kuphuma yikho inqubomgomo esebenzayo, hhayi ifayela elisendaweni yokugcina.

Ukwenza ukwabelana okukodwa kube mncane nakho akwenzi lutho engxenyeni esele yeseva. Okunye ukwabelana, imigqa yamaphrinta nokuxhumeka kwe-IPC kugcina imithetho yako, ngakho isakhiwo esithembele ohlwini lwamakheli okwabelana okukodwa sivikela indlela eyodwa, hhayi umnini.

Amagama amabili okwabelana edrayivu eyodwa

Lapho idrayivu efanayo kufanele ifinyeleleke kubantu ababili kumakheli amabili, yiveze kabili ngamagama ahlukene. Ibhloko ngayinye ithwala i-akhawunti eyodwa nomthombo owodwa, okwenza ibhangqwana libe yinto isakhiwo esingayiphoqa. Izindleko ziwukuthi umuntu ngamunye usebenzisa igama lokwabelana elihlukile ukufinyelela amafayela afanayo, futhi lokho kufanele kube wushintsho olwenziwe ngamabom ohlangothini lweklayenti.

[shared-mira]
    path = /srv/shared
    guest ok = no
    read only = yes
    valid users = mira
    hosts allow = 10.77.0.21
    hosts deny = ALL

[shared-tomas]
    path = /srv/shared
    guest ok = no
    read only = yes
    valid users = tomas
    hosts allow = 10.77.0.22
    hosts deny = ALL

Isango lokwabelana alisona isimvume sohlelo lwamafayela. Zombili izinhlangothi zisadinga ukufinyelela idrayivu nge-ACL engaphansi, futhi isilungiselelo sokufunda kuphela siyisendlalelo sesibili, hhayi esisodwa kuphela. Nikeza imvume yokubhala kuphela uma ukuhamba komsebenzi kukudinga, bese uhlola ukuthi amafayela adalwe uhlangothi olulodwa asahlala esebenziseka kolunye.

Zombili ibhloko zikhomba endleleni eyodwa, ngakho ushintsho edrayivu luthinta kokubili ukwabelana. Ngokuvamile lokho kuyinhloso, kodwa futhi kusho ukuthi iphutha lemvume libonakala kubasebenzisi bobabili ngasikhathi sinye.

Ikheli lomthombo lingafakazela ini

Ikheli i-Samba elibonayo yilelo elifinyelele iseva, hhayi lelo iklayenti elicabanga ukuthi linalo. Isango le-VPN elihumusha iklayenti ngalinye libe yikheli elilodwa lomthombo lisusa lowo mehluko: wonke amaklayenti afika njengomnini ofanayo futhi uhlu lwemithombo alusakwazi ukuhlukanisa. Ukwabiwa okuzinzile kuklayenti ngakunye nesango eligcina umthombo kuyizimo zokuqala zokusebenzisa amakheli njengenqubomgomo nhlobo. Ngaphandle kwakho kokubili, umkhawulo ulinga isango, hhayi umsebenzisi.

Noma kunjalo, ikheli akilona idivayisi. Amakhompyutha aphathekayo amabili ngemuva kwekheli elilodwa lomhubhe, isivumelwano esabiwe kabusha nendawo yokusebenza eyabiwe konke kuphika umbono wokuthi umthombo ukhomba umuntu. Thatha umkhawulo njengobubanzi benethiwekhi futhi gcina ama-akhawunti e-SMB afakazelwe njengesendlalelo sobunikazi, nesitifiketi sobufakazi bedivayisi uma udinga imvume yedivayisi.

Yingakho isakhiwo sivala ukwabelana hhayi iseva. Ibhangqwana elinqatshiwe lisengavula isikhathi, lifinyelele okunye ukwabelana noma libale iseva, okuwumphumela ohlukile ekwehlulekeni kofakazo ngesikhathi sokuxhumeka. Uma isidingo siwukwenqatshwa ngaphambi kofakazo, amapharamitha okwabelana e-Samba ayithuluzi elingalungile.

Fakazela ngamabhangqwana awelayo

Qinisekisa isakhiwo, bese uhlola izinhlanganisela ezine ngokuxhumeka okusha hhayi ngesikhathi esisetshenzisiwe futhi. Ibhangqwana elihlosiwe kufanele lifinyelele idrayivu, futhi amabhangqwana amabili awelayo kufanele ehluleke. Isikhathi esigciniwe esivela ekuhloleni kwangaphambili sizophendula ngokuzimisela ukuhlanganisela okungalungile futhi senze umthetho ophukile ubonakale ulungile.

testparm -s
smbclient //fileserver/shared-mira -U mira -c 'ls'
smbclient //fileserver/shared-tomas -U tomas -c 'ls'
smbstatus --shares

Ukuhlolwa kohlelo lolimi kufakazela kuphela ukuthi ifayela liyahlaziywa. Ubufakazi, ama-ACL nesinqumo somnini kuhlolwa ngokuxhumeka kwangempela, ngakho gijimisa umyalo weklayenti kusukela ekhelini ofuna ukulihlola bese ubheka ukuthi yisiphi isigaba esilinqabayo. Uma ibhangqwana eliwelayo liphumelela, uhlu lwemikhosi olusebenzayo lubanzi kunalokho okushiwo ibhloko, futhi i-testparm -s yinto yokuqala okufanele ifundwe. Uma ibhangqwana eliwelayo lehluleka ngesizathu esingalungile, i-akhawunti noma i-ACL kuyisola.

Ukuqapha izikhathi nge-smbstatus nokuzibulala kuyisenzo sokuphendula ngemuva kokuqala kokufinyelela, hhayi ukulawula ukungena. Ukuvimba ikheli eliphelele eliqaphelwe kungase futhi kunqamule abasebenzisi abangahlobene ngemuva kwe-NAT efanayo, ngakho isinqumo singesencazelo yokwabelana futhi ukuqapha kungesohlelo lokuphendula. Gcina kokubili kuhlukene futhi isakhiwo sihlala sithembekile ngalokho elikupoqayo.