Difference between revisions of "OPS335 Samba Lab"

From CDOT Wiki
Jump to: navigation, search
(Created page with 'FOCUS: Automating System Backup This lab will show you how to set up a Fedora installed system to be used for file backups. PART A: Requirements: You will need two PCs to do thi…')
 
m (fixing warning.)
 
(105 intermediate revisions by 3 users not shown)
Line 1: Line 1:
−
FOCUS: Automating System Backup
+
[[Category:OPS335]][[Category:OPS335 Labs]]
−
This lab will show you how to set up a Fedora installed system to be used for file backups.
+
=Samba - A Windows SMB/CIFS fileserver for UNIX=
 +
{{Admon/important|Warning| Make sure that your VMs are fully updated before you begin this lab. }}
  
−
PART A: Requirements:
+
==Configuring a Samba Server on Linux==
−
You will need two PCs to do this lab. We'll use one real PC (your hard drive running Fedora 13) and one virtual PC (created with Fedora's virtual machine manager).
+
*On your VM 2 install Samba
−
Your real Fedora 13 system (installed on your hard drive) should be updated to the latest software and should be using the default server firewall.
+
  dnf install samba samba-client
−
Your virtual Fedora 13 system (installed as a guest VM) should also be updated to the latest software and should be using the default server firewall.
+
*Create a backup of the file /etc/samba/smb.conf, and create a new one that includes only the following:
−
Also ensure that the ssh server is running on both host and guest machines.
+
[global]
−
Also ensure the clocks on both machines are set to the correct date and time.
+
workgroup = <yourlearnid>.org
−
Your virtual system will be used to backup files from the host machine. Your setup should look like the following diagram. Once your setup is correct proceed to PART B.
+
server string = "put your real name here without the quotes"
 +
encrypt passwords = yes
 +
smb passwd file = /etc/samba/smbpasswd
 +
 
 +
[home]
 +
comment = "put your real name here without the quotes"
 +
path = /home/<learnid>
 +
public = no
 +
writable = yes
 +
printable = no
 +
create mask = 0765
 +
*Now add a parameter to the global section that will limit access to the share so that only machines in your virtual network and those in the lab room will be able to access it.
 +
*Add a parameter to the home section so that only your user account can access that share.
 +
*Create a Samba password for user <learnid> with the command
 +
smbpasswd -a <learnid>
 +
*If you need to, you can change a user's password by using the command
 +
smbpasswd <username>
 +
*Confirm the user you created has been added using the following command
 +
pdbedit -L -v
 +
*Test and review your configuration with the command
 +
testparm
 +
*You can now start your Samba server (smb.service) and ensure it will start at boot.  
 +
*Modify the firewall on VM2 to allow samba traffic.
 +
*Test if you have a connection with the command
 +
smbclient -U <learnid> -L vm2
 +
*It will show you a list of all available shares.
  
−
PART B: Using rsync and cron to automate system backup:
+
=Connecting to a Linux SMB Server from a Linux Client=
−
Login to vm01 as joker and open a terminal window. Then "su -" to root run the following two commands:
+
There are many ways that a Linux client can connect to an SMB server.
−
mkdir /backup
 
−
rsync -avz 192.168.122.1:/etc/ /backup/etc
 
−
Still on vm01 run this command to verify rsync worked correctly:
 
−
ls /backup/etc
 
−
Notice that when running rsync you had to enter the password for root on f13. To automate this process so that it will run without requiring a password we'll use an RSA public/private key pair for passwordless authentication. To do this we'll have to generate an RSA public/private key pair on vm01. We'll use an openssh command like this:
 
−
ssh-keygen -t rsa
 
−
 
−
when you enter this command just hit ENTER for all the questions.
 
−
Here's what I got when I ran it on my vm01
 
  
−
Generating public/private rsa key pair.
+
== Using smbclient ==
−
Enter file in which to save the key (/root/.ssh/id_rsa):
+
*In a full installation you should not need to install samba-client on your host, but if it is not present then do so.
−
Enter passphrase (empty for no passphrase):
+
*You will also need to install the cifs-utils package to be able to mount the filesystem.
−
Enter same passphrase again:
+
*From the host use the "smbclient" command in a terminal window.
−
Your identification has been saved in /root/.ssh/id_rsa.
+
smbclient '\\vm2\home' -U <learnid>
−
Your public key has been saved in /root/.ssh/id_rsa.pub.
+
*After entering your password you should get a prompt similar to
−
The key fingerprint is:
+
smb: \>
−
f5:07:8c:aa:b6:08:e0:45:81:ca:d6:88:8c:aa:1a:7b root@vm01@localdomain
+
*Enter the ls command to see a list of the files in your home directory - you may receive the following error.
−
The key's randomart image is:
+
smb: \> ls
−
+--[ RSA 2048]----+
+
NT_STATUS_ACCESS_DENIED listing \*
−
|      o+++      |
+
*SE Linux should be in Enforcing and will need to be adjusted (on the samba server) for this to work.
−
|    E .ooo..    |
+
  setsebool -P samba_enable_home_dirs 1
−
|    ...o.      |
+
*Once you have access to the directory use the get and put commands (similar to ftp) to move files.
−
|      ...o    .|
+
*When you are finished close the connection.
−
|      .S+ +  o.|
 
−
|        . = . o .|
 
−
|          o +  |
 
−
|          o +    |
 
−
|          . .  |
 
−
+-----------------+
 
−
Now you'll need to copy vm01's public rsa key over to f13. Still on vm01 use this command (be sure you have the /root/.ssh/ directory on f13 - if you don't then make it first):
 
−
scp /root/.ssh/id_rsa.pub 192.168.122.1:/root/.ssh/authorized_keys2
 
−
Now verify that your new authentication method is working. Still on vm01 try to ssh to f13 as root. You should be able to login without entering a password. If you were successful then move on to the next step, otherwise repeat steps 3 and 4.
 
−
Install mailx on vm01 if it's not already installed.
 
−
Now, still as root on vm01, use the command 'crontab -e' to edit root's cron table. Insert the following line:
 
−
15 * * * * /usr/bin/rsync -avz 192.168.122.1:/etc/ /backup/etc
 
−
At 15 minutes past the hour rsync should synchronize the /etc/ directory of f13 to the /backup/etc/ directory on vm01. If this time has passed and you don't want to wait an hour for the next time rsync runs, just edit root's cron table on vm01 and enter another time for the backup to take place.
 
−
You should convince yourself that /etc/ is being backed up by adding some file (say 'touch /etc/junk' on f13) to /etc and then see if it was indeed copied to vm01.
 
−
After the cron job runs, root on vm01 should have received an email containing the output of the cron job. Verify this by using the mail command to check root's mail on vm01.
 
−
Finally, edit root's cron table on vm01 and add another record to backup the /home directory of f13 to /backup on vm01 once each week at 2am on Saturday.
 
−
PART C: Using syslog to route log files to a remote host:
 
−
On your host machine (f13) edit /etc/rsyslog.conf and make the following change:
 
−
change
 
−
#*.* @@remote-host:514
 
−
to
 
−
*.* @@192.168.122.xxx:514
 
−
where xxx is the IP of vm01 (your logging machine)
 
  
−
Now restart your rsyslog service (service rsyslog restart).
+
== Using 'mount -t cifs' ==
−
Go back on to vm01 and edit /etc/rsyslog.conf and make the following change:
+
*The next way is to use the mount command.
−
change these two lines
+
*Use the mount command on the host to mount your home directory
−
#$ModLoad imtcp.so
+
mkdir /tmp/vm2-home
−
#$InputTCPServerRun 514
+
mount -t cifs //vm2/home /tmp/vm2-home -o username=<learnid>
−
to
+
ls /tmp/vm2-home
−
$ModLoad imtcp.so
 
−
$InputTCPServerRun 514
 
−
Still on vm01, restart syslog. NOTE: At this point you should use iptables to open up tcp port 514 on vm01.
 
−
Now go back onto f13 and use the logger command to verify logging messages are getting through to vm01. Try this command
 
−
logger -p user.warn "Hello World"
 
−
Use the command "tail /var/log/messages" on vm01 to view the results of the previous step.
 
−
PART D: Answer the following questions and and email them to your teacher in ASCII text format.
 
  
−
What is your full name and 9-digit Seneca student ID?
+
== Using Nautilus to browse Samba shares ==
−
Show the RSA public key generated on vm01. i.e. the file called id_rsa.pub.
+
*Use the "Places" menu from the desktop and open 'Browse Network'.
−
Explain the meaning of the -avz options on the rsync command.
+
*From the menu in the side-bar of the files tool, choose 'Connect to Server'.
−
What did root's cron table on vm01 look like after step 11 of PART B?
+
*Enter 'smb://vm2/home' as the location, and enter your samba password in the prompt.
−
What were the last two lines of the email sent to root upon completion of the cron job in PART B step 10?
+
**Where vm2 is the name of the server, and home is the name of the directory it is sharing.
−
What was shown in PART C step 6?
+
*After you have checked that you can access your files, unmount the share by right-clicking its icon in the side-bar and clicking 'Unmount'.
−
What is the output of the iptables-save command on vm01 at the end of this lab?
+
 
 +
== Using a browser ==
 +
*You can also use a web browser with support for the SMB protocol such as Konqueror.
 +
**Note that firefox does not have such support.
 +
*If Konqueror is not installed then install it with the command:
 +
yum install kdebase
 +
*Start Konqueror, the web/file browser, and in the address bar enter the following
 +
smb://vm2/home
 +
*Enter your username and password when prompted.
 +
*Double click on a file you have some text in.
 +
**Open it with gedit, make some changes, and save it.
 +
**When prompted, choose to upload the file.
 +
*Close Konqueror.
 +
*cat the file on your VM2 to ensure the changes were properly uploaded.
 +
 
 +
=Connecting to a Linux SMB Server from a Windows Client (Windows 7)=
 +
*Power up a Windows 7 system in the lab and login using your LEARN username and password.
 +
*Add the prerouting and forwarding rules to your Centos host's iptables necessary to redirect samba traffic from outside your network to your VM 2.
 +
*Open up Explorer and Right click on Computer > Map network drive.. > Select a Drive Letter and '\\<ip-address-of-host>\home' > you will then be asked for your username and password.
 +
*You should now be able to browser, drag and drop your files to and from the Windows machine.
 +
==Completing the Lab==
 +
While completing this lab you have gained experience using a service designed to allow interaction from a variety of client tools on multiple OS platforms.  You have also experienced service related tools that allow you to view configuration parameters and errors in real-time.
 +
 
 +
Exploration questions:
 +
#What is the purpose of the testparm command?
 +
#What does SMB stand for? CIFS?
 +
#What does the text inside square brackets in the smb.conf file mean? (e.g., "[home]").
 +
#Explain the meaning of the line "create mask = 0765" in the smb.conf file?
 +
#What does the smbpasswd command do?
 +
#What did the setsebool command do?

Latest revision as of 17:15, 4 November 2015

Samba - A Windows SMB/CIFS fileserver for UNIX

Important.png
Warning
Make sure that your VMs are fully updated before you begin this lab.

Configuring a Samba Server on Linux

  • On your VM 2 install Samba
 dnf install samba samba-client
  • Create a backup of the file /etc/samba/smb.conf, and create a new one that includes only the following:
[global]
workgroup = <yourlearnid>.org 
server string = "put your real name here without the quotes"
encrypt passwords = yes
smb passwd file = /etc/samba/smbpasswd
  
[home]
comment = "put your real name here without the quotes"
path = /home/<learnid>
public = no
writable = yes
printable = no
create mask = 0765
  • Now add a parameter to the global section that will limit access to the share so that only machines in your virtual network and those in the lab room will be able to access it.
  • Add a parameter to the home section so that only your user account can access that share.
  • Create a Samba password for user <learnid> with the command
smbpasswd -a <learnid>
  • If you need to, you can change a user's password by using the command 
smbpasswd <username>
  • Confirm the user you created has been added using the following command
pdbedit -L -v
  • Test and review your configuration with the command
testparm
  • You can now start your Samba server (smb.service) and ensure it will start at boot.
  • Modify the firewall on VM2 to allow samba traffic.
  • Test if you have a connection with the command
smbclient -U <learnid> -L vm2
  • It will show you a list of all available shares.

Connecting to a Linux SMB Server from a Linux Client

There are many ways that a Linux client can connect to an SMB server.

Using smbclient

  • In a full installation you should not need to install samba-client on your host, but if it is not present then do so.
  • You will also need to install the cifs-utils package to be able to mount the filesystem.
  • From the host use the "smbclient" command in a terminal window.
smbclient '\\vm2\home' -U <learnid>
  • After entering your password you should get a prompt similar to
smb: \>
  • Enter the ls command to see a list of the files in your home directory - you may receive the following error.
smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*
  • SE Linux should be in Enforcing and will need to be adjusted (on the samba server) for this to work.
 setsebool -P samba_enable_home_dirs 1
  • Once you have access to the directory use the get and put commands (similar to ftp) to move files.
  • When you are finished close the connection.

Using 'mount -t cifs'

  • The next way is to use the mount command.
  • Use the mount command on the host to mount your home directory
mkdir /tmp/vm2-home
mount -t cifs //vm2/home /tmp/vm2-home -o username=<learnid>
ls /tmp/vm2-home

Using Nautilus to browse Samba shares

  • Use the "Places" menu from the desktop and open 'Browse Network'.
  • From the menu in the side-bar of the files tool, choose 'Connect to Server'.
  • Enter 'smb://vm2/home' as the location, and enter your samba password in the prompt.
    • Where vm2 is the name of the server, and home is the name of the directory it is sharing.
  • After you have checked that you can access your files, unmount the share by right-clicking its icon in the side-bar and clicking 'Unmount'.

Using a browser

  • You can also use a web browser with support for the SMB protocol such as Konqueror.
    • Note that firefox does not have such support.
  • If Konqueror is not installed then install it with the command: 
yum install kdebase
  • Start Konqueror, the web/file browser, and in the address bar enter the following
smb://vm2/home
  • Enter your username and password when prompted.
  • Double click on a file you have some text in.
    • Open it with gedit, make some changes, and save it.
    • When prompted, choose to upload the file.
  • Close Konqueror.
  • cat the file on your VM2 to ensure the changes were properly uploaded.

Connecting to a Linux SMB Server from a Windows Client (Windows 7)

  • Power up a Windows 7 system in the lab and login using your LEARN username and password.
  • Add the prerouting and forwarding rules to your Centos host's iptables necessary to redirect samba traffic from outside your network to your VM 2.
  • Open up Explorer and Right click on Computer > Map network drive.. > Select a Drive Letter and '\\<ip-address-of-host>\home' > you will then be asked for your username and password.
  • You should now be able to browser, drag and drop your files to and from the Windows machine.

Completing the Lab

While completing this lab you have gained experience using a service designed to allow interaction from a variety of client tools on multiple OS platforms. You have also experienced service related tools that allow you to view configuration parameters and errors in real-time.

Exploration questions:

  1. What is the purpose of the testparm command?
  2. What does SMB stand for? CIFS?
  3. What does the text inside square brackets in the smb.conf file mean? (e.g., "[home]").
  4. Explain the meaning of the line "create mask = 0765" in the smb.conf file?
  5. What does the smbpasswd command do?
  6. What did the setsebool command do?
Retrieved from "https://wiki.cdot.senecapolytechnic.ca/w/index.php?title=OPS335_Samba_Lab&oldid=113221"