Top > FreeBSD > samba 3.6 jail minitree 10.2-Release
samba 3.6 を jail minitree として導入した備忘的まとめです
samba 3.6 chroot minitree 9.0-Releaseを参考に chroot から jail minitree へ
さらに jail.conf を使用するように変更しています
基本的にjail fulltree環境での作業になります
事前に /root/maintenance に maintenace ShellScript環境を用意しておきます
# cd /usr/ports/net/samba36 # make config オプションメニュー LDAP With LDAP support ADS With Active Directory support CUPS With CUPS printing support WINBIND With WinBIND support SWAT With SWAT WebGUI ACL_SUPPORT With ACL support AIO_SUPPORT With Asyncronous IO support FAM_SUPOORT With File Alteration Monitor SYSLOG With Syslog support QUOTAS With Disk quota support UTMP With UTMP accounting support PAM_SMBPASS With PAM authentication vs passdb backends DNSUPDATE With dynamic DNS update(require ADS) AVAHI With Bonjour service discovery support EXP_MODULES With experimental modules PORT With system-wide PORT library IPV6 With IPv6 support MAX_DEBUG With maximum debugging SMBTORTURE With smbtorture
# pkg_replace -vcCN net/samba36
# cd /root/maintenance/config # vi samba36.txt # samba /usr/local/sbin/nmbd /usr/local/sbin/smbd /usr/local/bin/pdbedit /usr/local/etc/smb.conf /usr/local/etc/smb.conf.sample #syslog-ng /usr/local/sbin/syslog-ng /usr/local/sbin/syslog-ng-ctl # miniroot /etc/group /etc/host.conf /etc/hosts /etc/localtime /etc/master.passwd /etc/passwd /etc/printcap /etc/pwd.db /etc/resolv.conf /etc/spwd.db /usr/sbin/nologin # library /libexec/ld-elf.so.1 /usr/local/lib/libiconv/libiconv.so.* /usr/local/lib/syslog-ng/* # directory #mkdir /dev #mkdir /tmp #mkdir /usr/local/etc/samba #mkdir /usr/local/private #mkdir /var/db/samba #mkdir /var/log/samba #mkdir /var/run/samba # share directory #mkdir /var/samba # log.nmdb log.smdb /dev/null #comm ln -s /dev/null ./var/log/samba/log.nmbd #comm ln -s /dev/null ./var/log/samba/log.smbd
# ../makembeddedtree.sh samba36.txt /tmp/samba36
# vipw -d /tmp/samba36/etc root:*:0:0::0:0:Charlie &:/root:/usr/sbin/nologin toor:*:0:0::0:0:Bourne-again Superuser:/root: daemon:*:1:1::0:0:Owner of many system processes:/root:/usr/sbin/nologin nobody:*:65534:65534::0:0:Unprivileged user:/nonexistent:/usr/sbin/nologin
# vi /tmp/samba36/etc/group wheel:*:0:root daemon:*:1: nobody:*:65534:
echo 'ALL : ALL : deny' > /tmp/samba36/etc/hosts.allow
[global] workgroup = WORKGROUP netbios name = SAMBA server string = Samba %v hosts allow = 192.168.1. interfaces = re0 socket address = 192.168.1.232 bind interfaces only = yes nmbd bind explicit broadcast = no security = user encrypt passwords = yes domain logons = yes domain master = yes local master = yes wins support = yes preferred master = yes os level = 65 dos charset = eucjp-ms unix charset = UTF-8 display charset = UTF-8 create mask = 0774 directory mask = 0774 passdb backend = tdbsam load printers = no [samba] path=/var/samba writeable = Yes
/usr/sbin/pw -V /tmp/samba36/etc groupadd samba -g 20000 /usr/sbin/pw -V /tmp/samba36/etc useradd tail -u 29999 -g 20000 -s /usr/sbin/nologin -d /nonexistent
# exit # zfs create -o mountpoint=/jail/samba36 tank0/jail/samba36 # mv /jail/mainte/tmp/samba36/* /jail/samba36
# mount -t devfs devfs /jail/samba36/dev # jail /jail/samba36 test.localdomain 192.168.1.200 /usr/local/sbin/nmbd # ls -la /jail/samba36/var/log/samba
# cd /jail/samba36/var # chmod 774 samba # chown root:20000 samba
nmbd smbd の順番で起動するように設定します
# vi /etc/jail.conf
samba36 {
mount.devfs;
devfs_ruleset = $devfs_jail_inet;
allow.raw_sockets = "1";
// allow.sysvipc = "1";
jid = "232";
$ip4addr = "192.168.1.232/24";
/* inet */
ip4.addr = ${ip4addr};
interface = ${int_if};
exec.prestart = "";
exec.start = "";
exec.poststart = "";
exec.prestop = "";
exec.stop = "";
exec.poststop = "";
vnet.interface = "";
/* inet */
/* vnet
vnet;
/* vnet */
exec.prestart += "";
exec.start += "/usr/local/sbin/syslog-ng";
exec.poststart += "jexec $name /usr/local/sbin/nmbd -D -s /usr/local/etc/smb.conf";
exec.poststart += "jexec $name /usr/local/sbin/smbd -D -s /usr/local/etc/smb.conf";
exec.prestop += "";
exec.stop += "";
exec.poststop += "pkill -F ${path}/var/run/samba/smbd.pid";
exec.poststop += "pkill -F ${path}/var/run/samba/nmbd.pid";
/* persist */
persist;
/* depend */
// depend;
}
# vi /etc/rc.conf jail_list="..... samba36"
# vi /etc/pf.conf
# interface
ext_if="re0"
# network address
table <int_network> const {192.168.1.0/24}
int_samba ="192.168.1.232"
# port
port_nmb ="{137,138}"
scrub in all
# nat(int)
rdr pass on $ext_if proto udp from any to ($ext_if:broadcast) port port_nmb -> $int_samba
# vi /etc/rc.conf # pf pf_enable="YES" pf_flags="" pflog_enable="YES" gateway_enable="YES"
# vi smbuser.sh #!/bin/sh smbDir=/jail/samba36 smbGroup=20000 case "$1" in add) /usr/sbin/pw -V $smbDir/etc useradd -n $2 -u $3 -g $smbGroup -s /usr/sbin/nologin -d /nonexistent chroot $smbDir /usr/local/bin/pdbedit -a -u $2 ;; del) chroot $smbDir /usr/local/bin/pdbedit -x -u $2 /usr/sbin/pw -V $smbDir/etc userdel -n $2 ;; chpw) chroot $smbDir /usr/local/bin/pdbedit -x -u $2 chroot $smbDir /usr/local/bin/pdbedit -a -u $2 *) echo " usage: $0 add username uid" echo " $0 del username" echo " $0 chpw username" esac
