文件服务器
1.要求
ZZSRV2.BIGCLOUD.LOCAL使用Samba、FTP、NFS来提供文件服务。
此服务器上单独安装1块100GB的磁盘，使用LVM来进行卷管理：
VG名称：DATAVG
使用全部的100GB物理磁盘
创建三个LV
LV名称 | 大小 | 文件系统 | MountPoint | 用途 |
LVSMB | 40GB | ext4 | /smb | SAMBA |
LVFTP | 30GB | ext4 | /ftp | FTP目录 |
LVNFS | 20GB | ext4 | /nfs | NFS目录 |
上述所有卷要求服务器启动时自动挂载
1.1 SAMBA
共享名 | 路径 | 权限 | 备注 |
SHAREDOCS | /smb/docs | 公司所有人员包括来宾均可以访问 | |
RDDOCS | /smb/tech | 仅允许研发组的用户进行读写访问 |
备注：研发组的组名为RD，目前的Alice、Jack、Tom三个人
1.2 FTP
路径 | 权限 | 备注 |
/ftp/open | 公司所有人员包括来宾均可以访问 | 只读 |
/ftp/private | 仅允许Alice、Jack、Tom三个人访问 | Alice、Jack只允许下载， Tom可以上传 |
2.实验环境：
# uname -a
Linux zzsrv1.bigcloud.local3.10.0-123.el7.x86_64 #1 SMP Mon Jun 30 12:09:22 UTC 2014 x86_64 x86_64 x86_64GNU/Linux
# cat /etc/redhat-release
CentOS Linux release 7.0.1406 (Core)
3.实验步骤
3.1 磁盘配置
首先添加一个100G的硬盘
查看磁盘信息
# fdisk -l
Disk /dev/sda: 42.9 GB, 42949672960 bytes,83886080 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes /512 bytes
I/O size (minimum/optimal): 512 bytes / 512bytes
Disk label type: dos
Disk identifier: 0x0003c31b
Device Boot Start End Blocks Id System
/dev/sda1 * 2048 1026047 512000 83 Linux
/dev/sda2 1026048 83886079 41430016 8e Linux LVM
Disk /dev/sdb: 107.4 GB, 107374182400bytes, 209715200 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes /512 bytes
I/O size (minimum/optimal): 512 bytes / 512bytes
对sdb分区
# fdisk /dev/sdb
# fdisk -l /dev/sdb
Disk /dev/sdb: 107.4 GB, 107374182400bytes, 209715200 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes /512 bytes
I/O size (minimum/optimal): 512 bytes / 512bytes
Disk label type: dos
Disk identifier: 0x4b2d2a4e
Device Boot Start End Blocks Id System
/dev/sdb1 2048 209715199 104856576 8e Linux LVM
3.2 LVM配置
创建pv
# pvcreate /dev/sdb1
Physical volume "/dev/sdb1" successfully created
创建vg--DATAVG
# vgcreate DATAVG /dev/sdb1
Volume group "DATAVG" successfully created
创建三个lv--LVSMB、LVFTP、LVNFS
# lvcreate -n LVSMB -L 40G DATAVG
Logical volume "LVSMB" created
# lvcreate -n LVFTP -L 30G DATAVG
Logical volume "LVFTP" created
# vgdisplay DATAVG
---Volume group ---
VG Name DATAVG
System ID
Format lvm2
Metadata Areas 1
Metadata Sequence No 3
VGAccess read/write
VGStatus resizable
MAXLV 0
CurLV 2
Open LV 0
MaxPV 0
CurPV 1
ActPV 1
VGSize 100.00 GiB
PESize 4.00 MiB
Total PE 25599
Alloc PE / Size 17920 /70.00 GiB
Free PE / Size 7679 / 30.00 GiB
VGUUID 3nOyTr-IUnZ-TGFQ-E4id-84rL-XfW9-lu1tbj
# lvcreate -n LVNFS -l 7679 DATAVG
Logical volume "LVNFS" created
3.3 文件系统配置
格式化LV
#mkfs.ext4 /dev/DATAVG/LVSMB
# mkfs.ext4/dev/DATAVG/LVFTP
# mkfs.ext4/dev/DATAVG/LVNFS
创建3个挂载点
# mkdir /smb
# mkdir /ftp
# mkdir /nfs
设置为开机自动挂载
# vi /etc/fstab
在最后添加3行如下
/dev/DATAVG/LVSMB /smb ext4 defaults 0 0
/dev/DATAVG/LVFTP /ftp ext4 defaults 0 0
/dev/DATAVG/LVNFS /nfs ext4 defaults 0 0
挂载LV
# mount /smb
# mount /ftp
# mount /nfs
查看挂载信息
# mount
/dev/mapper/DATAVG-LVSMB on /smb type ext4(rw,relatime,data=ordered)
/dev/mapper/DATAVG-LVFTP on /ftp type ext4(rw,relatime,data=ordered)
/dev/mapper/DATAVG-LVNFS on /nfs type ext4(rw,relatime,data=ordered)
3.4 SAMBA配置
3.4.1安装samba包
#yum -y install samba samba-client samba-common
3.4.2 配置samba
创建共享目录
# mkdir -p /smb/docs
# mkdir -p /smb/tech
配置内核参数
# ulimit -n 16384
# vi /etc/security/limits.conf
在最后加入
* - nofile 16384
# cd /etc/samba
修改之前先备份
# cp smb.conf smb.conf.origin
# vi /etc/samba/smb.conf
在配置文件中删除原有内容，添加如下内容
[global]
workgroup=BIGCLOUD
netbios name=zzsrv2
server string=Samba Server
security=user
map to guest=Bad User
[SHAREDOCS]
path=/smb/docs
readonly=yes
browseable=yes
guest ok=yes
[RDDOCS]
path = /smb/tech/
public = no
writable = yes
write list = @RD
valid users = @RD
创建用户
# useradd alice
# useradd jack
# useradd tom
# useradd RD
修改3个用户的附加组为RD组
# usermod -a -G RD alice
# usermod -a -G RD jack
# usermod -a -G RD tom
查看
# id alice
uid=1001(alice) gid=1001(alice)groups=1001(alice),1004(RD)
创建三个samba用户
# smbpasswd -a alice
# smbpasswd -a jack
# smbpasswd -a tom
将共享目录/smb/tech的属组改为RD
# chown RD:RD /smb/tech
修改权限
# chmod 770 /smb/tech
# ll -d /smb/tech
drwxrwx--- 2 RD RD 4096 Aug 20 23:21/smb/tech
重启samba服务
# systemctl restart smb
设置samba为自动启动
# systemctl enable smb
# testparm
Load smb config files from/etc/samba/smb.conf
Processing section "[SHAREDOCS]"
Processing section "[RDDOCS]"
Loaded services file OK.
Server role: ROLE_STANDALONE
Press enter to see a dump of your servicedefinitions
[global]
workgroup = BIGCLOUD
server string = Samba Server
map to guest = Bad User
idmap config * : backend = tdb
[SHAREDOCS]
path = /smb/docs
guest ok = Yes
[RDDOCS]
path = /smb/tech/
valid users = @RD
write list = @RD
read only = No
3.4.3 测试
在linux上测试：
# smbclient -L localhost -U alice@P@ssw0rd
Enter alice@P@ssw0rd's password:
Anonymous login successful
Domain=[BIGCLOUD] OS=[Unix] Server=[Samba4.1.1]
Sharename Type Comment
--------- ---- -------
SHAREDOCS Disk
RDDOCS Disk
IPC$ IPC IPC Service (Samba Server)
Anonymous login successful
Domain=[BIGCLOUD] OS=[Unix] Server=[Samba4.1.1]
Server Comment
--------- -------
Workgroup Master
--------- -------
在windows上测试：
sharedocs文件夹不需登录即可访问，而rddocs只有RD组用户登录才能访问：
3.5 FTP配置
3.5.1安装ftp包
#yum -y install ftp vsftpd
# rpm -qa |grep db4-utils
# yum -y install db4-utils
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
No package db4-utils available.
Error: Nothing to do
# find / -name "db_load"
/usr/bin/db_load
# rpm -qf /usr/bin/db_load
libdb-utils-5.3.21-17.el7.x86_64
# rpm -qc vsftpd
/etc/logrotate.d/vsftpd
/etc/pam.d/vsftpd
/etc/vsftpd/ftpusers
/etc/vsftpd/user_list
/etc/vsftpd/vsftpd.conf
3.5.2 配置公共访问的目录（公司所有人员包括来宾均可以访问/ftp/open)
# mkdir /ftp/open
创建测试文件
# echo opentest > /ftp/open/open.txt
# echo filetest > /tmp/filetest1.txt
# touch /ftp/open/anontest.txt
# cd /etc/vsftpd
# cp vsftpd.conf vsftpd.conf.origin
创建密码明文文件，存放用户名和密码
# vi /etc/vsftpd/vftpuser.txt
alice
P@ssw0rd
jack
P@ssw0rd
tom
P@ssw0rd
根据明文创建密码DB文件
# db_load -T -t hash -f /etc/vsftpd/vftpuser.txt /etc/vsftpd/vftpuser.db
查看DB文件
# file /etc/vsftpd/vftpuser.db
/etc/vsftpd/vftpuser.db: Berkeley DB (Hash,version 9, native byte-order)
创建vsftpd的guest账户
# useradd -d /ftp/private -s /sbin/nologinvftpuser
修改pam.d文件
# vi /etc/pam.d/vsftpd
将auth和account行注释掉，添加最后2行
#%PAM-1.0 session optional pam_keyinit.so force revoke #auth required pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed #auth required pam_shells.so #auth include password-auth #account include password-auth session required pam_loginuid.so session include password-auth auth required pam_userdb.so db=/etc/vsftpd/vftpuser account required pam_userdb.so db=/etc/vsftpd/vftpuser |
# vi /etc/vsftpd/vsftpd.conf
在最后添加
anon_root=/ftp/open
virtual_use_local_privs=YES
guest_enable=YES
guest_username=vftpuser
chroot_local_user=YES
allow_writeable_chroot=YES
启动ftp服务
# systemctl start vsftpd
3.5.3 配置只有固定的人可访问的目录（只允许alice、jack、tom访问/ftp/private）
创建目录
# mkdir /ftp/private
创建vftpd的guest用户
# useradd -d /ftp/private -s /sbin/nologinvftpuser
useradd: warning: the home directoryalready exists.
Not copying any file from skel directoryinto it.
修改/ftp/private目录的属主和属组
# chown vftpuser:vftpuser /ftp/private
修改权限
# chmod 700 /ftp/private
# ll -ld /ftp/private
drwx------ 2 vftpuser vftpuser 4096 Aug 2103:00 /ftp/private
# vi /etc/vsftpd/vsftpd.conf
chroot_local_user=YES
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd/chroot_list
# vi /etc/vsftpd/chroot_list
alice
jack
tom
创建一个配置文件目录
# mkdir /etc/vsftpd/vftpd_user_conf
# cd /etc/vsftpd/vftpd_user_conf
分别为3个用户创建一个文件
# vi alice
write_enable=NO
anon_world_readable_only=NO
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
# vi jack（内容同alice一样）
# vi tom
write_enable=YES
anon_world_readable_only=NO
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
# vi /etc/vsftpd/vsftpd.conf
在配置文件最后增加一行
user_config_dir=/etc/vsftpd/vftpd_user_conf
# systemctl restart vsftpd
3.5.4 测试
匿名用户登录可以下载
# ftp localhost
...........
Name(localhost:root): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode(|||58297|).
150 Here comes the directory listing.
-rw-r--r-- 1 0 0 0 Aug 20 16:18 anontest.txt
-rw-r--r-- 1 0 0 9 Aug 20 16:17open.txt
226 Directory send OK.
ftp> lcd /tmp
Local directory now /tmp
ftp> get open.txt
local: open.txt remote: open.txt
229 Entering Extended Passive Mode(|||11728|).
150 Opening BINARY mode data connection foropen.txt (9 bytes).
226Transfer complete.
9 bytes received in 7e-05 secs (128.57Kbytes/sec)
ftp> bye
221 Goodbye.
alice用户可以下载，不可以上传
# cd /tmp
# ftp localhost
.........
Name (localhost:root): alice
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode(|||46306|).
150 Here comes the directory listing.
-rw-r--r-- 1 0 0 37 Aug 20 20:03test1
226 Directory send OK.
ftp> get test1
local: test1 remote: test1
229 Entering Extended Passive Mode(|||35448|).
150 Opening BINARY mode data connection fortest1 (37 bytes).
226 Transfer complete.
37 bytes received in 7.4e-05 secs (500.00Kbytes/sec)
ftp> put private1
local: private1 remote: private1
229 Entering Extended Passive Mode(|||61661|).
550 Permissiondenied.
jack用户可以下载，不可以上传
# ftp localhost
..........
Name (localhost:root): jack
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode(|||32394|).
150 Here comes the directory listing.
-rw-r--r-- 1 0 0 37 Aug 20 20:03test1
226 Directory send OK.
ftp> get test1
local: test1 remote: test1
229 Entering Extended Passive Mode(|||43956|).
150 Opening BINARY mode data connection fortest1 (37 bytes).
226 Transfer complete.
37 bytes received in 6.5e-05 secs (569.23Kbytes/sec)
ftp> put private2
local: private2 remote: private2
229 Entering Extended Passive Mode(|||53640|).
550 Permissiondenied.
tom用户可以下载也可以上传
# ftp localhost
.........
Name (localhost:root): tom
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode(|||10339|).
150 Here comes the directory listing.
-rw-r--r-- 1 0 0 37 Aug 20 20:03 test1
226 Directory send OK.
ftp> put private1
local: private1 remote: private1
229 Entering Extended Passive Mode(|||45878|).
150 Ok to send data.
226 Transfer complete.
ftp> ls
229 Entering Extended Passive Mode(|||58936|).
150 Here comes the directory listing.
-rw-r--r-- 1 1005 1005 0 Aug 20 20:12private1
-rw-r--r-- 1 0 0 37 Aug 20 20:03test1
226 Directory send OK.
