저는 주로 보안상의 이유로 Samba에서 더 높은 버전의 SMB(최소 2개)로 전환하기로 결정했습니다.
[global] 섹션에서 smb.conf에 추가해 보았습니다.
client min protocol = SMB2
client max protocol = SMB3
server min protocol = SMB2
그렇지 않으면
protocol=SMB2
시도할 때마다 삼바 또는 전체 서버를 다시 시작했습니다. 그러나 로그에는 다음과 같이 나와 있습니다.
[1970/01/01 01:01:12.085949, 0] smbd/negprot.c:706(reply_negprot)
No protocol supported !
[1970/01/01 01:01:13.153024, 0] smbd/negprot.c:706(reply_negprot)
No protocol supported !
[2018/11/04 12:10:25.080148, 0] param/loadparm.c:7997(lp_do_parameter)
Ignoring unknown parameter "server min protocol"
[2018/11/04 12:10:25.092055, 0] param/loadparm.c:7997(lp_do_parameter)
Ignoring unknown parameter "client min protocol"
[2018/11/04 12:10:30.803144, 0] param/loadparm.c:7997(lp_do_parameter)
Ignoring unknown parameter "server min protocol"
[2018/11/04 12:10:30.804260, 0] param/loadparm.c:7997(lp_do_parameter)
Ignoring unknown parameter "client min protocol"
검색해 보니 어떤 사람들은 FSTAB에서도 cuf를 구성하는 것으로 나타났습니다. 나는 그렇게 하지 않았고 smb.conf 때문에 작동했다고 생각합니다.
이것은 내 FSTAB입니다.
roc /proc proc defaults 0 0
/dev/mmcblk0p1 /boot vfat defaults 0 2
/dev/mmcblk0p2 / ext4 defaults,noatime 0 1
UUID=34150b89-5e8b-4769-8b68-f403659c58f7 /media/USBHD auto defaults,_netdev 0 2
다음은 공유 폴더를 정의하는 smb.conf 섹션입니다.
[USBHD]
comment=Dysk udostepniony
path = /media/USBHD
valid users = @users
force group = users
create mask = 0777
directory mask = 0777
read only = no
writeable = yes
browseable = yes
public = yes
FSTAB를 편집해야 합니까? 어떻게?
smb.conf의 MAN 페이지에서와 같이 버전 프로토콜을 구성하는 것이 언제 가능하며 FSTAB에서 이 작업을 수행해야 하는 경우는 언제입니까?
그럴 수도 있을 것 같아요최소한의 합의제가 사용하고 있는 Samba 버전에서는 이 기능을 사용하지 못할 수도 있습니다. 하지만 어쨌든 SMB2 프로토콜을 지원하는데 어떻게 활성화합니까?
삼바 버전 3.6.6
NAME="Raspbian GNU/Linux" VERSION_ID="7" VERSION="7 (헐떡임)"
커널: 4.1.19+
테스트 매개변수 -v
Load smb config files from /etc/samba/smb.conf
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Unknown parameter encountered: "client min protocol"
Ignoring unknown parameter "client min protocol"
Unknown parameter encountered: "client max protocol"
Ignoring unknown parameter "client max protocol"
Processing section "[homes]"
Processing section "[printers]"
Processing section "[print$]"
Processing section "[USBHD]"
Loaded services file OK.
Server role: ROLE_STANDALONE
Press enter to see a dump of your service definitions
[global]
display charset = LOCALE
workgroup = WORKGROUP
realm =
netbios name = RASPBERRYPI
netbios aliases =
netbios scope =
server string = %h server
interfaces =
bind interfaces only = No
security = USER
auth methods =
encrypt passwords = Yes
client schannel = Auto
server schannel = Auto
allow trusted domains = Yes
map to guest = Bad User
null passwords = No
obey pam restrictions = Yes
password server = *
smb passwd file = /etc/samba/smbpasswd
private dir = /etc/samba
passdb backend = tdbsam
algorithmic rid base = 1000
root directory =
guest account = nobody
enable privileges = Yes
pam password change = Yes
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword: * %n\n *password\supdated\ssuccessfully* .
passwd chat debug = No
passwd chat timeout = 2
check password script =
username map =
password level = 0
username level = 0
unix password sync = Yes
restrict anonymous = 0
lanman auth = No
ntlm auth = Yes
raw NTLMv2 auth = No
client NTLMv2 auth = Yes
client lanman auth = No
client plaintext auth = No
client use spnego principal = No
send spnego principal = No
preload modules =
dedicated keytab file =
kerberos method = default
map untrusted to domain = No
log level = 2
syslog = 0
syslog only = No
log file = /var/log/samba/log.%m
max log size = 1000
debug timestamp = Yes
debug prefix timestamp = No
debug hires timestamp = Yes
debug pid = No
debug uid = No
debug class = No
enable core files = Yes
smb ports = 445 139
large readwrite = Yes
max protocol = SMB2
min protocol = CORE
min receivefile size = 0
read raw = Yes
write raw = Yes
disable netbios = No
reset on zero vc = No
log writeable files on exit = No
acl compatibility = auto
defer sharing violations = Yes
nt pipe support = Yes
nt status support = Yes
announce version = 4.9
announce as = NT
max mux = 50
max xmit = 16644
name resolve order = lmhosts wins host bcast
max ttl = 259200
max wins ttl = 518400
min wins ttl = 21600
time server = No
unix extensions = Yes
allow dcerpc auth level connect = No
use spnego = Yes
client signing = auto
server signing = No
client use spnego = Yes
client ldap sasl wrapping = sign
enable asu support = No
svcctl list =
deadtime = 0
getwd cache = Yes
keepalive = 300
lpq cache time = 30
max smbd processes = 0
paranoid server security = Yes
max disk size = 0
max open files = 16384
socket options = TCP_NODELAY
use mmap = Yes
hostname lookups = No
name cache timeout = 660
ctdbd socket =
cluster addresses =
clustering = No
ctdb timeout = 0
ctdb locktime warn threshold = 0
smb2 max read = 65536
smb2 max write = 65536
smb2 max trans = 65536
smb2 max credits = 8192
load printers = Yes
printcap cache time = 750
printcap name =
cups server =
cups encrypt = No
cups connection timeout = 30
iprint server =
disable spoolss = No
addport command =
enumports command =
addprinter command =
deleteprinter command =
show add printer wizard = Yes
os2 driver map =
mangling method = hash2
mangle prefix = 1
max stat cache size = 256
stat cache = Yes
machine password timeout = 604800
add user script =
rename user script =
delete user script =
add group script =
delete group script =
add user to group script =
delete user from group script =
set primary group script =
add machine script =
shutdown script =
abort shutdown script =
username map script =
username map cache time = 0
logon script =
logon path = \\%N\%U\profile
logon drive =
logon home = \\%N\%U
domain logons = No
init logon delayed hosts =
init logon delay = 100
os level = 20
lm announce = Auto
lm interval = 60
preferred master = No
local master = Yes
domain master = Auto
browse list = Yes
enhanced browsing = Yes
dns proxy = No
wins proxy = No
wins server =
wins support = No
wins hook =
kernel oplocks = Yes
lock spin time = 200
oplock break wait time = 0
ldap admin dn =
ldap delete dn = No
ldap group suffix =
ldap idmap suffix =
ldap machine suffix =
ldap passwd sync = no
ldap replication sleep = 1000
ldap suffix =
ldap ssl = start tls
ldap ssl ads = No
ldap deref = auto
ldap follow referral = Auto
ldap timeout = 15
ldap connection timeout = 2
ldap page size = 1024
ldap user suffix =
ldap debug level = 0
ldap debug threshold = 10
eventlog list =
add share command =
change share command =
delete share command =
preload =
lock directory = /var/run/samba
state directory = /var/lib/samba
cache directory = /var/cache/samba
pid directory = /var/run/samba
utmp directory =
wtmp directory =
utmp = No
default service =
message command =
get quota command =
set quota command =
remote announce =
remote browse sync =
socket address = 0.0.0.0
nmbd bind explicit broadcast = Yes
homedir map = auto.home
afs username map =
afs token lifetime = 604800
log nt token command =
time offset = 0
NIS homedir = No
registry shares = No
usershare allow guests = Yes
usershare max shares = 100
usershare owner only = Yes
usershare path = /var/lib/samba/usershares
usershare prefix allow list =
usershare prefix deny list =
usershare template share =
allow insecure wide links = No
async smb echo handler = No
multicast dns register = Yes
panic action = /usr/share/samba/panic-action %d
perfcount module =
host msdfs = Yes
passdb expand explicit = No
idmap backend = tdb
idmap cache time = 604800
idmap negative cache time = 120
idmap uid =
idmap gid =
template homedir = /home/%D/%U
template shell = /bin/false
winbind separator = \
winbind cache time = 300
winbind reconnect delay = 30
winbind max clients = 200
winbind enum users = No
winbind enum groups = No
winbind use default domain = No
winbind trusted domains only = No
winbind nested groups = Yes
winbind expand groups = 1
winbind nss info = template
winbind refresh tickets = No
winbind offline logon = No
winbind normalize names = No
winbind rpc only = No
create krb5 conf = Yes
ncalrpc dir = /var/ncalrpc
winbind max domain connections = 1
idmap config * : backend = tdb
comment =
path =
username =
invalid users =
valid users =
admin users =
read list =
write list =
printer admin =
force user =
force group =
read only = Yes
acl check permissions = Yes
acl group control = No
acl map full control = Yes
create mask = 0744
force create mode = 00
security mask = 0777
force security mode = 00
directory mask = 0755
force directory mode = 00
directory security mask = 0777
force directory security mode = 00
force unknown acl user = No
inherit permissions = No
inherit acls = No
inherit owner = No
guest only = No
administrative share = No
guest ok = No
only user = No
hosts allow =
hosts deny =
allocation roundup size = 1048576
aio read size = 0
aio write size = 0
aio write behind =
ea support = No
nt acl support = Yes
profile acls = No
map acl inherit = No
afs share = No
smb encrypt = auto
block size = 1024
change notify = Yes
directory name cache size = 100
kernel change notify = Yes
max connections = 0
min print space = 0
strict allocate = No
strict sync = No
sync always = No
use sendfile = No
write cache size = 0
max reported print jobs = 0
max print jobs = 1000
printable = No
print notify backchannel = Yes
print ok = No
printing = cups
cups options =
print command =
lpq command = %p
lprm command =
lppause command =
lpresume command =
queuepause command =
queueresume command =
printer name =
use client driver = No
default devmode = Yes
force printername = No
printjob username = %U
default case = lower
case sensitive = Auto
preserve case = Yes
short preserve case = Yes
mangling char = ~
hide dot files = Yes
hide special files = No
hide unreadable = No
hide unwriteable files = No
delete veto files = No
veto files =
hide files =
veto oplock files =
map archive = Yes
map hidden = No
map system = No
map readonly = yes
mangled names = Yes
store dos attributes = No
dmapi support = No
browseable = Yes
access based share enum = No
blocking locks = Yes
csc policy = manual
fake oplocks = No
locking = Yes
oplocks = Yes
level2 oplocks = Yes
oplock contention limit = 2
posix locking = Yes
strict locking = Auto
share modes = Yes
dfree cache time = 0
dfree command =
copy =
preexec =
preexec close = No
postexec =
root preexec =
root preexec close = No
root postexec =
available = Yes
volume =
fstype = NTFS
set directory = No
wide links = No
follow symlinks = Yes
dont descend =
magic script =
magic output =
delete readonly = No
dos filemode = No
dos filetimes = Yes
dos filetime resolution = No
fake directory create times = No
vfs objects =
msdfs root = No
msdfs proxy =
[homes]
comment = Home Directories
valid users = %S
create mask = 0700
directory mask = 0700
browseable = No
[printers]
comment = All Printers
path = /var/spool/samba
create mask = 0700
printable = Yes
print ok = Yes
browseable = No
[print$]
comment = Printer Drivers
path = /var/lib/samba/printers
[USBHD]
comment = Dysk udostepniony
path = /media/USBHD
valid users = @users
force group = users
read only = No
create mask = 0777
directory mask = 0777
guest ok = Yes
답변1
SLES 11.4는 Samba가 기본적으로 SMBv1로만 설정될 만큼 오래되었습니다. client min protocol및 를 설정했습니다 client max protocol. 이는 Samba가 클라이언트인 경우에만 Samba에 영향을 미칩니다(예: ) smbclient.
서버 측에서는 해당 항목만 설정하므로 server min protocol여전히 server max protocol기본값은 SMBv1입니다. 그리고 이제 최소 프로토콜이 최대 프로토콜보다 높기 때문에 smbd실제로 어떤 프로토콜도 허용되지 않습니다.
SLES 11.4의 Samba가 너무 오래되었고 SMBv3 지원이 버그가 있는 것 같다는 사실(당신이 발견했듯이)로 인해 우리는 여전히 SLES 11.4를 실행하는 모든 Samba 서버를 작업 우선순위로 SLES 12 이상으로 업그레이드하게 되었습니다.
답변2
커널 3.0이 포함된 SLES 11.4에서 Samba-3.6.3을 실행하는 경우 전역 부분은 다음과 같습니다. Windows 10 클라이언트는 SMB1을 통해 연결하지 않기 때문에 SMB2가 작동한다는 것을 알고 있습니다. 기본적으로 Win10의 경우 최소 요구 사항은 SMB2입니다.
설정한 경우 Min Protocol = SMB2클라이언트가 Windows 7인 경우에는 작동하지 않습니다. 적어도 Windows 측의 문제 해결 방법을 파악하지 못한 경우에는 Win7의 경우 기본적으로 SMB1인 것 같습니다. win7에 있습니다. 수동 구성의 일부 내용에는 SMB2를 수행하라고 나와 있습니다.
어떤 이유로든 설정 max protocol = SMB3으로 인해 작동하지 않는 문제가 발생했기 때문에 SMB2를 지정했습니다.
[global]
min protocol = SMB2
max protocol = SMB2
workgroup = workgroup
passdb backend = tdbsam
map to guest = Never
usershare allow guests = No
add machine script = /usr/sbin/useradd -c Machine -d /var/lib/nobody -s /bin/false %m$
domain master = No
security = user
wins support = No
server signing = auto
name resolve order = lmhosts bcast host
printing = bsd
printcap name = /dev/null
log level = 2 auth:10 auth_audit:3 auth_json_audit:3 winbind:5
max log size = 1000000
그리고 내가 사용한 공유 예제
[data1]
create mask = 660
directory mask = 770
inherit acls = Yes
path = /data1
read only = No
/etc/fstab평소처럼 스토리지 리소스를 설치하는 것 외에 다른 작업을 수행할 필요가 없습니다. 그런 다음 설치가 완료되면 해당 폴더에 대한 액세스 권한이 있는지 확인하십시오. chmod 777 /data1내 예에서는 시작을 위해 연 다음 계속해서 월드 권한을 제거하고 필요에 따라 그룹 소유권 및 권한을 변경하십시오.