From 5cbc818b77dd1743ebac25a7b6f1bac3610a6ae5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=99=BD=E5=AE=A6=E6=88=90?= Date: Thu, 20 Aug 2015 01:21:17 +0800 Subject: [PATCH 1/6] RHCSA Series--Part 03-Done MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 更新完成 --- ...ow to Manage Users and Groups in RHEL 7.md | 224 ++++++++++++++++++ 1 file changed, 224 insertions(+) create mode 100644 translated/tech/RHCSA/RHCSA Series--Part 03--How to Manage Users and Groups in RHEL 7.md diff --git a/translated/tech/RHCSA/RHCSA Series--Part 03--How to Manage Users and Groups in RHEL 7.md b/translated/tech/RHCSA/RHCSA Series--Part 03--How to Manage Users and Groups in RHEL 7.md new file mode 100644 index 0000000000..1436621c4e --- /dev/null +++ b/translated/tech/RHCSA/RHCSA Series--Part 03--How to Manage Users and Groups in RHEL 7.md @@ -0,0 +1,224 @@ +RHCSA 系列: 如何管理RHEL7的用户和组 – Part 3 +================================================================================ +和管理其他Linux服务器一样，管理一个 RHEL 7 服务器 要求你能够添加，修改，暂停或删除用户帐户，并且授予他们文件,目录，其他系统资源所必要的权限。 +![User and Group Management in Linux](http://www.tecmint.com/wp-content/uploads/2015/03/User-and-Group-Management-in-Linux.png) + +RHCSA: 用户和组管理 – Part 3 + +### 管理用户帐户## + +如果想要给RHEL 7 服务器添加账户，你需要以root用户执行如下两条命令 + + # adduser [new_account] + # useradd [new_account] + +当添加新的用户帐户时，默认会执行下列操作。 + +- 他/她 的主目录就会被创建(一般是"/home/用户名"，除非你特别设置) +- 一些隐藏文件 如`.bash_logout`, `.bash_profile` 以及 `.bashrc` 会被复制到用户的主目录，并且会为用户的回话提供环境变量.你可以进一步查看他们的相关细节。 +- 会为您的账号添加一个邮件池目录 +- 会创建一个和用户名同样的组 + +用户帐户的全部信息被保存在`/etc/passwd `文件。这个文件以如下格式保存了每一个系统帐户的所有信息(以:分割) + [username]:[x]:[UID]:[GID]:[Comment]:[Home directory]:[Default shell] + +- `[username]` 和`[Comment]` 是用于自我解释的 +- ‘x’表示帐户的密码保护(详细在`/etc/shadow`文件)，就是我们用于登录的`[username]`. +- `[UID]` 和`[GID]`是用于显示`[username]` 的 用户认证和主用户组。 + +最后, + +- `[Home directory]`显示`[username]`的主目录的绝对路径 +- `[Default shell]` 是当用户登录系统后使用的默认shell + +另外一个你必须要熟悉的重要的文件是存储组信息的`/etc/group`.因为和`/etc/passwd`类似，所以也是由:分割 + [Group name]:[Group password]:[GID]:[Group members] + + + +- `[Group name]` 是组名 +- 这个组是否使用了密码 (如果是"X"意味着没有). +- `[GID]`: 和`/etc/passwd`中一样 +- `[Group members]`:用户列表，使用,隔开。里面包含组内的所有用户 + +添加过帐户后，任何时候你都可以通过 usermod 命令来修改用户战壕沟，基础的语法如下: + # usermod [options] [username] + +相关阅读 + +- [15 ‘useradd’ Command Examples][1] +- [15 ‘usermod’ Command Examples][2] + +#### 示例1 : 设置帐户的过期时间 #### + +如果你的公司有一些短期使用的帐户或者你相应帐户在有限时间内使用，你可以使用 `--expiredate` 参数 ，后加YYYY-MM-DD格式的日期。为了查看是否生效，你可以使用如下命令查看 + # chage -l [username] + +帐户更新前后的变动如下图所示 +![Change User Account Information](http://www.tecmint.com/wp-content/uploads/2015/03/Change-User-Account-Information.png) + +修改用户信息 + +#### 示例 2: 向组内追加用户 #### + +除了创建用户时的主用户组，一个用户还能被添加到别的组。你需要使用 -aG或 -append -group 选项，后跟逗号分隔的组名 +#### 示例 3: 修改用户主目录或默认Shell #### + +如果因为一些原因，你需要修改默认的用户主目录(一般为 /home/用户名)，你需要使用 -d 或 -home 参数，后跟绝对路径来修改主目录 +如果有用户想要使用其他的shell来取代bash(比如sh ),一般默认是bash .使用 usermod ，并使用 -shell 的参数，后加新的shell的路径 +#### 示例 4: 展示组内的用户 #### + +当把用户添加到组中后，你可以使用如下命令验证属于哪一个组 + + # groups [username] + # id [username] + +下面图片的演示了示例2到示例四 + +![Adding User to Supplementary Group](http://www.tecmint.com/wp-content/uploads/2015/03/Adding-User-to-Supplementary-Group.png) + +添加用户到额外的组 + +在上面的示例中: + + # usermod --append --groups gacanepa,users --home /tmp --shell /bin/sh tecmint + +如果想要从组内删除用户，省略 `--append` 切换，并且可以使用 `--groups` 来列举组内的用户 + +#### 示例 5: 通过锁定密码来停用帐户 #### + +如果想要关闭帐户，你可以使用 -l(小写的L)或 -lock 选项来锁定用户的密码。这将会阻止用户登录。 + +#### 示例 6: 解锁密码 #### + +当你想要重新启用帐户让他可以继续登录时，属于 -u 或 –unlock 选项来解锁用户的密码，就像示例5 介绍的那样 + + # usermod --unlock tecmint + +下面的图片展示了示例5和示例6 + +![Lock Unlock User Account](http://www.tecmint.com/wp-content/uploads/2015/03/Lock-Unlock-User-Account.png) + +锁定上锁用户 + +#### 示例 7:删除组和用户 #### + +如果要删除一个组，你需要使用 groupdel ，如果需要删除用户 你需要使用 userdel (添加 -r 可以删除主目录和邮件池的内容) + # groupdel [group_name] # 删除组 + # userdel -r [user_name] # 删除用户，并删除主目录和邮件池 + +如果一些文件属于组，他们将不会被删除。但是组拥有者将会被设置为删除掉的组的GID +### 列举，设置，并且修改 ugo/rwx 权限 ### + +著名的 [ls 命令][3] 是管理员最好的助手. 当我们使用 -l 参数, 这个工具允许您查看一个目录中的内容（或详细格式). + +而且，该命令还可以应用于单个文件中。无论哪种方式，在“ls”输出中的前10个字符表示每个文件的属性。 +这10个字符序列的第一个字符用于表示文件类型： + +- – (连字符): 一个标准文件 +- d: 一个目录 +- l: 一个符号链接 +- c: 字符设备（将数据作为字节流，即一个终端） +- b: 块设备（处理数据块，即存储设备） + +文件属性的下一个九个字符，分为三个组，被称为文件模式，并注明读（r），写（w），并执行（x）授予文件的所有者，文件的所有组，和其他的用户（通常被称为“世界”）。 +在文件的读取权限允许打开和读取相同的权限时，允许其内容被列出，如果还设置了执行权限，还允许它作为一个程序和运行。 +文件权限是通过chmod命令改变的，它的基本语法如下： + + # chmod [new_mode] file + +new_mode是一个八进制数或表达式，用于指定新的权限。适合每一个随意的案例。或者您已经有了一个更好的方式来设置文件的权限，所以你觉得可以自由地使用最适合你自己的方法。 +八进制数可以基于二进制等效计算，可以从所需的文件权限的文件的所有者，所有组，和世界。一定权限的存在等于2的幂（R = 22，W = 21，x = 20），没有时意为0。例如： +![File Permissions](http://www.tecmint.com/wp-content/uploads/2015/03/File-Permissions.png) + +文件权限 + +在八进制形式下设置文件的权限，如上图所示 + + # chmod 744 myfile + +请用一分钟来对比一下我们以前的计算，在更改文件的权限后，我们的实际输出为： + +![Long List Format](http://www.tecmint.com/wp-content/uploads/2015/03/Long-List-Format.png) + +长列表格式 + +#### 示例 8: 寻找777权限的文件 #### + +出于安全考虑，你应该确保在正常情况下，尽可能避免777权限（读、写、执行的文件）。虽然我们会在以后的教程中教你如何更有效地找到所有的文件在您的系统的权限集的说明，你现在仍可以使用LS grep获取这种信息。 +在下面的例子，我们会寻找 /etc 目录下的777权限文件. 注意，我们要使用第二章讲到的管道的知识[第二章：文件和目录管理][4]: + + # ls -l /etc | grep rwxrwxrwx + +![Find All Files with 777 Permission](http://www.tecmint.com/wp-content/uploads/2015/03/Find-All-777-Files.png) + +查找所有777权限的文件 + +#### 示例 9: 为所有用户指定特定权限 #### + +shell脚本，以及一些二进制文件，所有用户都应该有权访问（不只是其相应的所有者和组），应该有相应的执行权限（我们会讨论特殊情况下的问题）： + # chmod a+x script.sh + +**注意**: 我们可以设置文件模式使用表示用户权限的字母如“u”，组所有者权限的字母“g”，其余的为o 。所有权限为a.权限可以通过`+` 或 `-` 来管理。 + +![Set Execute Permission on File](http://www.tecmint.com/wp-content/uploads/2015/03/Set-Execute-Permission-on-File.png) + +为文件设置执行权限 + +长目录列表还显示了该文件的所有者和其在第一和第二列中的组主。此功能可作为系统中文件的第一级访问控制方法： + +![Check File Owner and Group](http://www.tecmint.com/wp-content/uploads/2015/03/Check-File-Owner-and-Group.png) + +检查文件的属主和属组 + +改变文件的所有者，您将使用chown命令。请注意，您可以在同一时间或单独的更改文件的所有权： + # chown user:group file + +虽然可以在同一时间更改用户或组，或在同一时间的两个属性，但是不要忘记冒号区分，如果你想要更新其他属性，让另外的选项保持空白： + # chown :group file # Change group ownership only + # chown user: file # Change user ownership only + +#### 示例 10:从一个文件复制权限到另一个文件#### + +If you would like to “clone” ownership from one file to another, you can do so using the –reference flag, as follows: +如果你想“克隆”一个文件的所有权到另一个，你可以这样做，使用–reference参数，如下： + # chown --reference=ref_file file + +ref_file的所有信息会复制给 file + +![Clone File Ownership](http://www.tecmint.com/wp-content/uploads/2015/03/Clone-File-Ownership.png) + +复制文件属主信息 + +### 设置 SETGID 协作目录 ### + +你应该授予在一个特定的目录中拥有访问所有的文件的权限给一个特点的用户组，你将有可能使用目录设置setgid的方法。当setgid后设置，真实用户的有效GID成为团队的主人。 +因此，任何用户都可以访问该文件的组所有者授予的权限的文件。此外，当setgid设置在一个目录中，新创建的文件继承同一组目录，和新创建的子目录也将继承父目录的setgid。 + # chmod g+s [filename] + +为了设置 setgid 在八进制形式，预先准备好数字2 来给基本的权限 + # chmod 2755 [directory] + +### 总结 ### + +扎实的用户和组管理知识，符合规则的,Linux权限管理，以及部分实践，可以帮你快速解决RHEL 7 服务器的文件权限。 +我向你保证，当你按照本文所概述的步骤和使用系统文档(和第一章解释的那样 [Part 1: Reviewing Essential Commands & System Documentation][5] of this series) 你将掌握基本的系统管理的能力。 + +请随时让我们知道你是否有任何问题或意见使用下面的表格。 + +-------------------------------------------------------------------------------- + +via: http://www.tecmint.com/rhcsa-exam-manage-users-and-groups/ + +作者：[Gabriel Cánepa][a] +译者：[xiqingongzi](https://github.com/xiqingongzi) +校对：[校对者ID](https://github.com/校对者ID) + +本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出 + +[a]:http://www.tecmint.com/author/gacanepa/ +[1]:http://www.tecmint.com/add-users-in-linux/ +[2]:http://www.tecmint.com/usermod-command-examples/ +[3]:http://www.tecmint.com/ls-interview-questions/ +[4]:http://www.tecmint.com/file-and-directory-management-in-linux/ +[5]:http://www.tecmint.com/rhcsa-exam-reviewing-essential-commands-system-documentation/ From a450026ce4ddab845ce40bffc5f6e6c86e79da78 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=99=BD=E5=AE=A6=E6=88=90?= Date: Thu, 20 Aug 2015 01:21:53 +0800 Subject: [PATCH 2/6] =?UTF-8?q?=E5=88=A0=E9=99=A4=E5=A4=9A=E4=BD=99?= =?UTF-8?q?=E6=96=87=E4=BB=B6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ...ow to Manage Users and Groups in RHEL 7.md | 249 ------------------ 1 file changed, 249 deletions(-) delete mode 100644 sources/tech/RHCSA Series/RHCSA Series--Part 03--How to Manage Users and Groups in RHEL 7.md diff --git a/sources/tech/RHCSA Series/RHCSA Series--Part 03--How to Manage Users and Groups in RHEL 7.md b/sources/tech/RHCSA Series/RHCSA Series--Part 03--How to Manage Users and Groups in RHEL 7.md deleted file mode 100644 index 0b85744c6c..0000000000 --- a/sources/tech/RHCSA Series/RHCSA Series--Part 03--How to Manage Users and Groups in RHEL 7.md +++ /dev/null @@ -1,249 +0,0 @@ -[translated by xiqingongzi] -RHCSA Series: How to Manage Users and Groups in RHEL 7 – Part 3 -================================================================================ -Managing a RHEL 7 server, as it is the case with any other Linux server, will require that you know how to add, edit, suspend, or delete user accounts, and grant users the necessary permissions to files, directories, and other system resources to perform their assigned tasks. - -![User and Group Management in Linux](http://www.tecmint.com/wp-content/uploads/2015/03/User-and-Group-Management-in-Linux.png) - -RHCSA: User and Group Management – Part 3 - -### Managing User Accounts ### - -To add a new user account to a RHEL 7 server, you can run either of the following two commands as root: - - # adduser [new_account] - # useradd [new_account] - -When a new user account is added, by default the following operations are performed. - -- His/her home directory is created (`/home/username` unless specified otherwise). -- These `.bash_logout`, `.bash_profile` and `.bashrc` hidden files are copied inside the user’s home directory, and will be used to provide environment variables for his/her user session. You can explore each of them for further details. -- A mail spool directory is created for the added user account. -- A group is created with the same name as the new user account. - -The full account summary is stored in the `/etc/passwd `file. This file holds a record per system user account and has the following format (fields are separated by a colon): - - [username]:[x]:[UID]:[GID]:[Comment]:[Home directory]:[Default shell] - -- These two fields `[username]` and `[Comment]` are self explanatory. -- The second filed ‘x’ indicates that the account is secured by a shadowed password (in `/etc/shadow`), which is used to logon as `[username]`. -- The fields `[UID]` and `[GID]` are integers that shows the User IDentification and the primary Group IDentification to which `[username]` belongs, equally. - -Finally, - -- The `[Home directory]` shows the absolute location of `[username]’s` home directory, and -- `[Default shell]` is the shell that is commit to this user when he/she logins into the system. - -Another important file that you must become familiar with is `/etc/group`, where group information is stored. As it is the case with `/etc/passwd`, there is one record per line and its fields are also delimited by a colon: - - [Group name]:[Group password]:[GID]:[Group members] - -where, - -- `[Group name]` is the name of group. -- Does this group use a group password? (An “x” means no). -- `[GID]`: same as in `/etc/passwd`. -- `[Group members]`: a list of users, separated by commas, that are members of each group. - -After adding an account, at anytime, you can edit the user’s account information using usermod, whose basic syntax is: - - # usermod [options] [username] - -Read Also: - -- [15 ‘useradd’ Command Examples][1] -- [15 ‘usermod’ Command Examples][2] - -#### EXAMPLE 1: Setting the expiry date for an account #### - -If you work for a company that has some kind of policy to enable account for a certain interval of time, or if you want to grant access to a limited period of time, you can use the `--expiredate` flag followed by a date in YYYY-MM-DD format. To verify that the change has been applied, you can compare the output of - - # chage -l [username] - -before and after updating the account expiry date, as shown in the following image. - -![Change User Account Information](http://www.tecmint.com/wp-content/uploads/2015/03/Change-User-Account-Information.png) - -Change User Account Information - -#### EXAMPLE 2: Adding the user to supplementary groups #### - -Besides the primary group that is created when a new user account is added to the system, a user can be added to supplementary groups using the combined -aG, or –append –groups options, followed by a comma separated list of groups. - -#### EXAMPLE 3: Changing the default location of the user’s home directory and / or changing its shell #### - -If for some reason you need to change the default location of the user’s home directory (other than /home/username), you will need to use the -d, or –home options, followed by the absolute path to the new home directory. - -If a user wants to use another shell other than bash (for example, sh), which gets assigned by default, use usermod with the –shell flag, followed by the path to the new shell. - -#### EXAMPLE 4: Displaying the groups an user is a member of #### - -After adding the user to a supplementary group, you can verify that it now actually belongs to such group(s): - - # groups [username] - # id [username] - -The following image depicts Examples 2 through 4: - -![Adding User to Supplementary Group](http://www.tecmint.com/wp-content/uploads/2015/03/Adding-User-to-Supplementary-Group.png) - -Adding User to Supplementary Group - -In the example above: - - # usermod --append --groups gacanepa,users --home /tmp --shell /bin/sh tecmint - -To remove a user from a group, omit the `--append` switch in the command above and list the groups you want the user to belong to following the `--groups` flag. - -#### EXAMPLE 5: Disabling account by locking password #### - -To disable an account, you will need to use either the -l (lowercase L) or the –lock option to lock a user’s password. This will prevent the user from being able to log on. - -#### EXAMPLE 6: Unlocking password #### - -When you need to re-enable the user so that he can log on to the server again, use the -u or the –unlock option to unlock a user’s password that was previously blocked, as explained in Example 5 above. - - # usermod --unlock tecmint - -The following image illustrates Examples 5 and 6: - -![Lock Unlock User Account](http://www.tecmint.com/wp-content/uploads/2015/03/Lock-Unlock-User-Account.png) - -Lock Unlock User Account - -#### EXAMPLE 7: Deleting a group or an user account #### - -To delete a group, you’ll want to use groupdel, whereas to delete a user account you will use userdel (add the –r switch if you also want to delete the contents of its home directory and mail spool): - - # groupdel [group_name] # Delete a group - # userdel -r [user_name] # Remove user_name from the system, along with his/her home directory and mail spool - -If there are files owned by group_name, they will not be deleted, but the group owner will be set to the GID of the group that was deleted. - -### Listing, Setting and Changing Standard ugo/rwx Permissions ### - -The well-known [ls command][3] is one of the best friends of any system administrator. When used with the -l flag, this tool allows you to view a list a directory’s contents in long (or detailed) format. - -However, this command can also be applied to a single file. Either way, the first 10 characters in the output of `ls -l` represent each file’s attributes. - -The first char of this 10-character sequence is used to indicate the file type: - -- – (hyphen): a regular file -- d: a directory -- l: a symbolic link -- c: a character device (which treats data as a stream of bytes, i.e. a terminal) -- b: a block device (which handles data in blocks, i.e. storage devices) - -The next nine characters of the file attributes, divided in groups of three from left to right, are called the file mode and indicate the read (r), write(w), and execute (x) permissions granted to the file’s owner, the file’s group owner, and the rest of the users (commonly referred to as “the world”), respectively. - -While the read permission on a file allows the same to be opened and read, the same permission on a directory allows its contents to be listed if the execute permission is also set. In addition, the execute permission in a file allows it to be handled as a program and run. - -File permissions are changed with the chmod command, whose basic syntax is as follows: - - # chmod [new_mode] file - -where new_mode is either an octal number or an expression that specifies the new permissions. Feel free to use the mode that works best for you in each case. Or perhaps you already have a preferred way to set a file’s permissions – so feel free to use the method that works best for you. - -The octal number can be calculated based on the binary equivalent, which can in turn be obtained from the desired file permissions for the owner of the file, the owner group, and the world.The presence of a certain permission equals a power of 2 (r=22, w=21, x=20), while its absence means 0. For example: - -![File Permissions](http://www.tecmint.com/wp-content/uploads/2015/03/File-Permissions.png) - -File Permissions - -To set the file’s permissions as indicated above in octal form, type: - - # chmod 744 myfile - -Please take a minute to compare our previous calculation to the actual output of `ls -l` after changing the file’s permissions: - -![Long List Format](http://www.tecmint.com/wp-content/uploads/2015/03/Long-List-Format.png) - -Long List Format - -#### EXAMPLE 8: Searching for files with 777 permissions #### - -As a security measure, you should make sure that files with 777 permissions (read, write, and execute for everyone) are avoided like the plague under normal circumstances. Although we will explain in a later tutorial how to more effectively locate all the files in your system with a certain permission set, you can -by now- combine ls with grep to obtain such information. - -In the following example, we will look for file with 777 permissions in the /etc directory only. Note that we will use pipelining as explained in [Part 2: File and Directory Management][4] of this RHCSA series: - - # ls -l /etc | grep rwxrwxrwx - -![Find All Files with 777 Permission](http://www.tecmint.com/wp-content/uploads/2015/03/Find-All-777-Files.png) - -Find All Files with 777 Permission - -#### EXAMPLE 9: Assigning a specific permission to all users #### - -Shell scripts, along with some binaries that all users should have access to (not just their corresponding owner and group), should have the execute bit set accordingly (please note that we will discuss a special case later): - - # chmod a+x script.sh - -**Note**: That we can also set a file’s mode using an expression that indicates the owner’s rights with the letter `u`, the group owner’s rights with the letter `g`, and the rest with `o`. All of these rights can be represented at the same time with the letter `a`. Permissions are granted (or revoked) with the `+` or `-` signs, respectively. - -![Set Execute Permission on File](http://www.tecmint.com/wp-content/uploads/2015/03/Set-Execute-Permission-on-File.png) - -Set Execute Permission on File - -A long directory listing also shows the file’s owner and its group owner in the first and second columns, respectively. This feature serves as a first-level access control method to files in a system: - -![Check File Owner and Group](http://www.tecmint.com/wp-content/uploads/2015/03/Check-File-Owner-and-Group.png) - -Check File Owner and Group - -To change file ownership, you will use the chown command. Note that you can change the file and group ownership at the same time or separately: - - # chown user:group file - -**Note**: That you can change the user or group, or the two attributes at the same time, as long as you don’t forget the colon, leaving user or group blank if you want to update the other attribute, for example: - - # chown :group file # Change group ownership only - # chown user: file # Change user ownership only - -#### EXAMPLE 10: Cloning permissions from one file to another #### - -If you would like to “clone” ownership from one file to another, you can do so using the –reference flag, as follows: - - # chown --reference=ref_file file - -where the owner and group of ref_file will be assigned to file as well: - -![Clone File Ownership](http://www.tecmint.com/wp-content/uploads/2015/03/Clone-File-Ownership.png) - -Clone File Ownership - -### Setting Up SETGID Directories for Collaboration ### - -Should you need to grant access to all the files owned by a certain group inside a specific directory, you will most likely use the approach of setting the setgid bit for such directory. When the setgid bit is set, the effective GID of the real user becomes that of the group owner. - -Thus, any user can access a file under the privileges granted to the group owner of such file. In addition, when the setgid bit is set on a directory, newly created files inherit the same group as the directory, and newly created subdirectories will also inherit the setgid bit of the parent directory. - - # chmod g+s [filename] - -To set the setgid in octal form, prepend the number 2 to the current (or desired) basic permissions. - - # chmod 2755 [directory] - -### Conclusion ### - -A solid knowledge of user and group management, along with standard and special Linux permissions, when coupled with practice, will allow you to quickly identify and troubleshoot issues with file permissions in your RHEL 7 server. - -I assure you that as you follow the steps outlined in this article and use the system documentation (as explained in [Part 1: Reviewing Essential Commands & System Documentation][5] of this series) you will master this essential competence of system administration. - -Feel free to let us know if you have any questions or comments using the form below. - --------------------------------------------------------------------------------- - -via: http://www.tecmint.com/rhcsa-exam-manage-users-and-groups/ - -作者：[Gabriel Cánepa][a] -译者：[译者ID](https://github.com/译者ID) -校对：[校对者ID](https://github.com/校对者ID) - -本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出 - -[a]:http://www.tecmint.com/author/gacanepa/ -[1]:http://www.tecmint.com/add-users-in-linux/ -[2]:http://www.tecmint.com/usermod-command-examples/ -[3]:http://www.tecmint.com/ls-interview-questions/ -[4]:http://www.tecmint.com/file-and-directory-management-in-linux/ -[5]:http://www.tecmint.com/rhcsa-exam-reviewing-essential-commands-system-documentation/ From c4c3eca5f243fd41b4cfa2da2cca0aa2bdf9517c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=99=BD=E5=AE=A6=E6=88=90?= Date: Thu, 20 Aug 2015 01:24:52 +0800 Subject: [PATCH 3/6] =?UTF-8?q?=E3=80=90=E7=BF=BB=E8=AF=91=E4=B8=AD?= =?UTF-8?q?=E3=80=91RHCSA=20Series--Part=2007?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ... (Access Control Lists) and Mounting Samba or NFS Shares.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sources/tech/RHCSA Series/RHCSA Series--Part 07--Using ACLs (Access Control Lists) and Mounting Samba or NFS Shares.md b/sources/tech/RHCSA Series/RHCSA Series--Part 07--Using ACLs (Access Control Lists) and Mounting Samba or NFS Shares.md index d4801d9923..f8d9d45d27 100644 --- a/sources/tech/RHCSA Series/RHCSA Series--Part 07--Using ACLs (Access Control Lists) and Mounting Samba or NFS Shares.md +++ b/sources/tech/RHCSA Series/RHCSA Series--Part 07--Using ACLs (Access Control Lists) and Mounting Samba or NFS Shares.md @@ -1,3 +1,4 @@ +[xiqingongzi Translating] RHCSA Series: Using ACLs (Access Control Lists) and Mounting Samba / NFS Shares – Part 7 ================================================================================ In the last article ([RHCSA series Part 6][1]) we started explaining how to set up and configure local system storage using parted and ssm. @@ -209,4 +210,4 @@ via: http://www.tecmint.com/rhcsa-exam-configure-acls-and-mount-nfs-samba-shares [a]:http://www.tecmint.com/author/gacanepa/ [1]:http://www.tecmint.com/rhcsa-exam-create-format-resize-delete-and-encrypt-partitions-in-linux/ [2]:http://www.tecmint.com/rhcsa-exam-manage-users-and-groups/ -[3]:https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Storage_Administration_Guide/ch-acls.html \ No newline at end of file +[3]:https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Storage_Administration_Guide/ch-acls.html From b36ab92cb463c9c947bb4070a29c89a11247f4c7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=99=BD=E5=AE=A6=E6=88=90?= Date: Fri, 28 Aug 2015 02:46:10 +0800 Subject: [PATCH 4/6] =?UTF-8?q?=E3=80=90=E7=BF=BB=E8=AF=91=E5=AE=8C?= =?UTF-8?q?=E6=88=90=E3=80=91RHCSA=20Series--Part=2007?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 翻译完成第七篇 --- ...Lists) and Mounting Samba or NFS Shares.md | 192 ++++++++++++++++++ 1 file changed, 192 insertions(+) create mode 100644 translated/tech/RHCSA/RHCSA Series--Part 07--Using ACLs (Access Control Lists) and Mounting Samba or NFS Shares.md diff --git a/translated/tech/RHCSA/RHCSA Series--Part 07--Using ACLs (Access Control Lists) and Mounting Samba or NFS Shares.md b/translated/tech/RHCSA/RHCSA Series--Part 07--Using ACLs (Access Control Lists) and Mounting Samba or NFS Shares.md new file mode 100644 index 0000000000..a9c56b1cbe --- /dev/null +++ b/translated/tech/RHCSA/RHCSA Series--Part 07--Using ACLs (Access Control Lists) and Mounting Samba or NFS Shares.md @@ -0,0 +1,192 @@ +[xiqingongzi Translating] +RHCSA Series: Using ACLs (Access Control Lists) and Mounting Samba / NFS Shares – Part 7 +================================================================================ +在第六篇文章的最后，我们开始解释如何使用parted和SSM 设置和配置本地文件存储([RHCSA series Part 6][1]) + +![Configure ACL's and Mounting NFS / Samba Shares](http://www.tecmint.com/wp-content/uploads/2015/04/Configure-ACLs-and-Mounting-NFS-Samba-Shares.png) + +RHCSA系列：：第七章 ACL的配置和安装NFS/Samba文件分享系统 + +我们还讨论了如何创建和在启动启动时用密码挂载加密逻辑卷。另外，我们要提醒您要避免在安装 在管理操作系统的存储文件系统事执行关键的操作。接下来我们要回顾在红帽Linux 7 中常用的文件系统格式然后卸载和挂载网络文件系统（CIFS和NFS）， +#### 前提 #### + +在开始之前，请确保你有一个线上Samba服务器和一个线上NFS服务器（RHEL7 将很快不支持 NFS V2） + +在这个指南中,我们将使用一个IP为192.168.0.10的机器作为服务端，RHEL7 盒子作为客户端，IP为192.168.0.18，稍后我们会告诉你该安装哪些软件包。 + +### RHEL7中的文件格式 ### + +从RHEL7 开始，XFS 因为其高可用性和可拓展性被设置为所有架构的默认文件系统。目前，红帽和合作伙伴测试的主流硬件线上他支持最大500TB 每个文件系统。 +同时，XFS使user_xattr（扩展用户属性）和ACL（POSIX访问控制列表）作为默认的挂载选项，不像ext3或ext4（ext2在RHEL 7中是过时的），这意味着你不需要明确的指定命令行选项或在/etc/fstab挂载时XFS文件系统（如果你想禁用在后一种情况下，这样的选择你要明确使用no_acl和no_user_xattr）。 +记住，扩展用户属性可以指定文件和目录用于存储任意等附加信息的MIME类型，字符集或文件的编码，而对用户属性的访问权限由普通文件权限位的定义。 +#### 权限控制列表 #### + +每一个系统管理员，无论新手还是专家，都熟悉文件和目录的权限和许可。它能制定特定的权限(读，写和执行)的所有者，属组，和其他的正常访问权限。如果需要，可以回去看看 [Part 3 of the RHCSA series][2] +然而，由于标准的 ugo/rwx 设置不允许配置不同用户不同权限，所以ACL可以比一般规定更多的文件和目录权限。 +事实上，ACL定义的权限是文件权限的一个超集，我们来看一下在真正的场景下是如何转换的。 +1. 有两种类型：访问ACL (可以适用于任何一个特定的文件或目录），也是默认的ACL，它只能应用于目录。如果文件包含在其中没有ACL设置，他们继承父目录的默认ACL。 +2. 首先，ACL可以配置每个用户，每个组，或不在组内的用户拥有文件。 +3。设置ACL（和删除）使用setfacl，分别使用M或X选项。 +例如，让我们创建一个组名为tecmint和添加用户johndoe和davenull： + # groupadd tecmint + # useradd johndoe + # useradd davenull + # usermod -a -G tecmint johndoe + # usermod -a -G tecmint davenull + +让我们确认用户属于组tecmint： + + # id johndoe + # id davenull + +![Verify Users](http://www.tecmint.com/wp-content/uploads/2015/04/Verify-Users.png) + +验证用户 + +Let’s now create a directory called playground within /mnt, and a file named testfile.txt inside. We will set the group owner to tecmint and change its default ugo/rwx permissions to 770 (read, write, and execute permissions granted to both the owner and the group owner of the file): +现在让我们创建一个在/mnt下的目录名为playground，和一个名叫testfile.txt文件。我们将tecmint和更改其默认 ugo/rwx 权限为 770组所有者（读，写，和执行给予属主和属组所有者权限）： + # mkdir /mnt/playground + # touch /mnt/playground/testfile.txt + # chmod 770 /mnt/playground/testfile.txt + +然后切换用户johndoe和davenull，按照这个顺序，并写入文件： + + echo "My name is John Doe" > /mnt/playground/testfile.txt + echo "My name is Dave Null" >> /mnt/playground/testfile.txt + +到目前为止很好。现在，让我们的用户gacanepa写入文件–和写操作，可以预料到出现的结果。 + +但如果我们真的需要用户gacanepa（不是tecmint组的成员）有/mnt/playground/testfile.txt的写入权限。首先，可能是你的想法是添加用户帐户组tecmint。但这会给他写上所有文件的权限，写入的是该组的权限，我们不希望这样。我们只希望他能写/mnt/playground/ testfile.txt。 + + # touch /mnt/playground/testfile.txt + # chown :tecmint /mnt/playground/testfile.txt + # chmod 777 /mnt/playground/testfile.txt + # su johndoe + $ echo "My name is John Doe" > /mnt/playground/testfile.txt + $ su davenull + $ echo "My name is Dave Null" >> /mnt/playground/testfile.txt + $ su gacanepa + $ echo "My name is Gabriel Canepa" >> /mnt/playground/testfile.txt + +![Manage User Permissions](http://www.tecmint.com/wp-content/uploads/2015/04/User-Permissions.png) + +管理用户权限 + +让我们给用户gacanepa添加/mnt/playground/testfile.txt的读写权限 +在root下执行 + + # setfacl -R -m u:gacanepa:rwx /mnt/playground + +您已经成功添加了一个ACL允许gacanepa写入测试文件。然后切换到用户gacanepa试图写入文件： + + $ echo "My name is Gabriel Canepa" >> /mnt/playground/testfile.txt + +要查看特定的文件或目录的ACL，使用getfacl： + + # getfacl /mnt/playground/testfile.txt + +![Check ACLs of Files](http://www.tecmint.com/wp-content/uploads/2015/04/Check-ACL-of-File.png) + +检查文件的ACLs + +设置默认ACL目录（它的内容将会继承除非被覆盖），添加d:以前的规则并且指定一个文件名来替代 + # setfacl -m d:o:r /mnt/playground + +以上的ACL将允许用户不在属组属主有/mnt/playground的读权限。注意在getfacl /mnt/playground 之前和之后的改变输出的差异： +![Set Default ACL in Linux](http://www.tecmint.com/wp-content/uploads/2015/04/Set-Default-ACL-in-Linux.png) + +Set Default ACL in Linux + +[Chapter 20 in the official RHEL 7 Storage Administration Guide][3] 提供了更多ACL的例子，我强烈推荐你去读读它，参考起来非常方便。 + +#### 安装NFS网络共享 #### + +显示在你的服务器的NFS共享可用的列表，您可以使用showmount命令与E选项，其次是机器名或IP地址。这个工具包含在NFS utils包： + + # yum update && yum install nfs-utils + +然后: + + # showmount -e 192.168.0.10 + +你会得到一个列表的可用的NFS分享192.168.0.10： +![Check Available NFS Shares](http://www.tecmint.com/wp-content/uploads/2015/04/Mount-NFS-Shares.png) + +Check Available NFS Shares + +在使用命令行对必要的本地客户端挂载NFS网络共享，使用以下语法： + + # mount -t nfs -o [options] remote_host:/remote/directory /local/directory + +在我们的例子中，翻译成： + + # mount -t nfs 192.168.0.10:/NFS-SHARE /mnt/nfs + +如果您收到一下错误消息:"rpc-statd.service工作失败,看 “systemctl status rpc-statd.service” 和“journalctl -xn” 获取详细信息.确保你的rpcbind服务在开机时开启。 + # systemctl enable rpcbind.socket + # systemctl restart rpcbind.service + +然后重新启动。这应该做的技巧，你将能够挂载NFS共享就和前面所解释的那样。如果你需要安装NFS共享的自动引导系统，添加一个有效的条目到/etc/fstab文件： + + 远程主机:远程目录 本地目录 nfs 选项 0 0 + +变量远程主机, 远程目录, 本地目录, and 选项 (可选的)在我们手动挂载是谁同样的，就和我们之前的例子一样。 + + 192.168.0.10:/NFS-SHARE /mnt/nfs nfs defaults 0 0 + +#### 挂载 Samba 网络文件共享 #### + +Samba 代表选择可以在×nix和Windows之间进行网络共享的工具.使用Samba客户端包内的 smbclient 命令 加 -L 参数来展示 Samba 文件分享，其次是机器名或IP地址 +将会提示你输入远程主机上的密码: + # smbclient -L 192.168.0.10 + +![Check Samba Shares](http://www.tecmint.com/wp-content/uploads/2015/04/Check-Samba-Shares.png) + +Check Samba Shares + +在本地客户端，你需要首先安装CIFS utils来挂载Samba： + + # yum update && yum install cifs-utils + +然后在命令行上使用下面的语法： + + # mount -t cifs -o credentials=/path/to/credentials/file //remote_host/samba_share /local/directory + +在我们的例子中，翻译成： + + # mount -t cifs -o credentials=~/.smbcredentials //192.168.0.10/gacanepa /mnt/samba + +smbcredentials内容为: + + username=gacanepa + password=XXXXXX + +是一个隐藏文件在root的主目录（/root/），权限设置为600，因此，除了该文件的所有者可以读或写，没有人能够读写。 +请注意，samba_share是Samba共享的名字就像 smbclient -L remote_host 返回的那样 + +现在，如果你需要samba共享可自动在系统启动时，添加一个有效的条目/etc/fstab文件如下： + + //远程主机:/samba_share 本地目录 cifs 选项 0 0 + +变量 远程主机, /samba_share, 本地目录, 选项 (可选的) 和我们手动安装的意义一样 + + //192.168.0.10/gacanepa /mnt/samba cifs credentials=/root/smbcredentials,defaults 0 0 + +### 结论 ### + +在这篇文章中我们已经讲解了如何在Linux设置ACL，并探讨RHEL7中该如何挂载CIFS和NFS网络共享。 +我建议你去实践这些概念，甚至把它们一起安装（先尝试安装网络共享设置ACL）如果你有疑问或意见，请随时使用下面的表格，随时与我们联系。还可以通过你的社交网络来分享这篇文章。 +-------------------------------------------------------------------------------- + +via: http://www.tecmint.com/rhcsa-exam-configure-acls-and-mount-nfs-samba-shares/ + +作者：[Gabriel Cánepa][a] +译者：[xiqingongzi](https://github.com/xiqingongzi) +校对：[校对者ID](https://github.com/校对者ID) + +本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出 + +[a]:http://www.tecmint.com/author/gacanepa/ +[1]:http://www.tecmint.com/rhcsa-exam-create-format-resize-delete-and-encrypt-partitions-in-linux/ +[2]:http://www.tecmint.com/rhcsa-exam-manage-users-and-groups/ +[3]:https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Storage_Administration_Guide/ch-acls.html From 4180b6aa1f70ff8fe1852ce8c2eb19fd8195123c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=99=BD=E5=AE=A6=E6=88=90?= Date: Fri, 28 Aug 2015 02:46:32 +0800 Subject: [PATCH 5/6] Delete RHCSA Series--Part 07--Using ACLs (Access Control Lists) and Mounting Samba or NFS Shares.md --- ...Lists) and Mounting Samba or NFS Shares.md | 213 ------------------ 1 file changed, 213 deletions(-) delete mode 100644 sources/tech/RHCSA Series/RHCSA Series--Part 07--Using ACLs (Access Control Lists) and Mounting Samba or NFS Shares.md diff --git a/sources/tech/RHCSA Series/RHCSA Series--Part 07--Using ACLs (Access Control Lists) and Mounting Samba or NFS Shares.md b/sources/tech/RHCSA Series/RHCSA Series--Part 07--Using ACLs (Access Control Lists) and Mounting Samba or NFS Shares.md deleted file mode 100644 index f8d9d45d27..0000000000 --- a/sources/tech/RHCSA Series/RHCSA Series--Part 07--Using ACLs (Access Control Lists) and Mounting Samba or NFS Shares.md +++ /dev/null @@ -1,213 +0,0 @@ -[xiqingongzi Translating] -RHCSA Series: Using ACLs (Access Control Lists) and Mounting Samba / NFS Shares – Part 7 -================================================================================ -In the last article ([RHCSA series Part 6][1]) we started explaining how to set up and configure local system storage using parted and ssm. - -![Configure ACL's and Mounting NFS / Samba Shares](http://www.tecmint.com/wp-content/uploads/2015/04/Configure-ACLs-and-Mounting-NFS-Samba-Shares.png) - -RHCSA Series:: Configure ACL’s and Mounting NFS / Samba Shares – Part 7 - -We also discussed how to create and mount encrypted volumes with a password during system boot. In addition, we warned you to avoid performing critical storage management operations on mounted filesystems. With that in mind we will now review the most used file system formats in Red Hat Enterprise Linux 7 and then proceed to cover the topics of mounting, using, and unmounting both manually and automatically network filesystems (CIFS and NFS), along with the implementation of access control lists for your system. - -#### Prerequisites #### - -Before proceeding further, please make sure you have a Samba server and a NFS server available (note that NFSv2 is no longer supported in RHEL 7). - -During this guide we will use a machine with IP 192.168.0.10 with both services running in it as server, and a RHEL 7 box as client with IP address 192.168.0.18. Later in the article we will tell you which packages you need to install on the client. - -### File System Formats in RHEL 7 ### - -Beginning with RHEL 7, XFS has been introduced as the default file system for all architectures due to its high performance and scalability. It currently supports a maximum filesystem size of 500 TB as per the latest tests performed by Red Hat and its partners for mainstream hardware. - -Also, XFS enables user_xattr (extended user attributes) and acl (POSIX access control lists) as default mount options, unlike ext3 or ext4 (ext2 is considered deprecated as of RHEL 7), which means that you don’t need to specify those options explicitly either on the command line or in /etc/fstab when mounting a XFS filesystem (if you want to disable such options in this last case, you have to explicitly use no_acl and no_user_xattr). - -Keep in mind that the extended user attributes can be assigned to files and directories for storing arbitrary additional information such as the mime type, character set or encoding of a file, whereas the access permissions for user attributes are defined by the regular file permission bits. - -#### Access Control Lists #### - -As every system administrator, either beginner or expert, is well acquainted with regular access permissions on files and directories, which specify certain privileges (read, write, and execute) for the owner, the group, and “the world” (all others). However, feel free to refer to [Part 3 of the RHCSA series][2] if you need to refresh your memory a little bit. - -However, since the standard ugo/rwx set does not allow to configure different permissions for different users, ACLs were introduced in order to define more detailed access rights for files and directories than those specified by regular permissions. - -In fact, ACL-defined permissions are a superset of the permissions specified by the file permission bits. Let’s see how all of this translates is applied in the real world. - -1. There are two types of ACLs: access ACLs, which can be applied to either a specific file or a directory), and default ACLs, which can only be applied to a directory. If files contained therein do not have a ACL set, they inherit the default ACL of their parent directory. - -2. To begin, ACLs can be configured per user, per group, or per an user not in the owning group of a file. - -3. ACLs are set (and removed) using setfacl, with either the -m or -x options, respectively. - -For example, let us create a group named tecmint and add users johndoe and davenull to it: - - # groupadd tecmint - # useradd johndoe - # useradd davenull - # usermod -a -G tecmint johndoe - # usermod -a -G tecmint davenull - -And let’s verify that both users belong to supplementary group tecmint: - - # id johndoe - # id davenull - -![Verify Users](http://www.tecmint.com/wp-content/uploads/2015/04/Verify-Users.png) - -Verify Users - -Let’s now create a directory called playground within /mnt, and a file named testfile.txt inside. We will set the group owner to tecmint and change its default ugo/rwx permissions to 770 (read, write, and execute permissions granted to both the owner and the group owner of the file): - - # mkdir /mnt/playground - # touch /mnt/playground/testfile.txt - # chmod 770 /mnt/playground/testfile.txt - -Then switch user to johndoe and davenull, in that order, and write to the file: - - echo "My name is John Doe" > /mnt/playground/testfile.txt - echo "My name is Dave Null" >> /mnt/playground/testfile.txt - -So far so good. Now let’s have user gacanepa write to the file – and the write operation will, which was to be expected. - -But what if we actually need user gacanepa (who is not a member of group tecmint) to have write permissions on /mnt/playground/testfile.txt? The first thing that may come to your mind is adding that user account to group tecmint. But that will give him write permissions on ALL files were the write bit is set for the group, and we don’t want that. We only want him to be able to write to /mnt/playground/testfile.txt. - - # touch /mnt/playground/testfile.txt - # chown :tecmint /mnt/playground/testfile.txt - # chmod 777 /mnt/playground/testfile.txt - # su johndoe - $ echo "My name is John Doe" > /mnt/playground/testfile.txt - $ su davenull - $ echo "My name is Dave Null" >> /mnt/playground/testfile.txt - $ su gacanepa - $ echo "My name is Gabriel Canepa" >> /mnt/playground/testfile.txt - -![Manage User Permissions](http://www.tecmint.com/wp-content/uploads/2015/04/User-Permissions.png) - -Manage User Permissions - -Let’s give user gacanepa read and write access to /mnt/playground/testfile.txt. - -Run as root, - - # setfacl -R -m u:gacanepa:rwx /mnt/playground - -and you’ll have successfully added an ACL that allows gacanepa to write to the test file. Then switch to user gacanepa and try to write to the file again: - - $ echo "My name is Gabriel Canepa" >> /mnt/playground/testfile.txt - -To view the ACLs for a specific file or directory, use getfacl: - - # getfacl /mnt/playground/testfile.txt - -![Check ACLs of Files](http://www.tecmint.com/wp-content/uploads/2015/04/Check-ACL-of-File.png) - -Check ACLs of Files - -To set a default ACL to a directory (which its contents will inherit unless overwritten otherwise), add d: before the rule and specify a directory instead of a file name: - - # setfacl -m d:o:r /mnt/playground - -The ACL above will allow users not in the owner group to have read access to the future contents of the /mnt/playground directory. Note the difference in the output of getfacl /mnt/playground before and after the change: - -![Set Default ACL in Linux](http://www.tecmint.com/wp-content/uploads/2015/04/Set-Default-ACL-in-Linux.png) - -Set Default ACL in Linux - -[Chapter 20 in the official RHEL 7 Storage Administration Guide][3] provides more ACL examples, and I highly recommend you take a look at it and have it handy as reference. - -#### Mounting NFS Network Shares #### - -To show the list of NFS shares available in your server, you can use the showmount command with the -e option, followed by the machine name or its IP address. This tool is included in the nfs-utils package: - - # yum update && yum install nfs-utils - -Then do: - - # showmount -e 192.168.0.10 - -and you will get a list of the available NFS shares on 192.168.0.10: - -![Check Available NFS Shares](http://www.tecmint.com/wp-content/uploads/2015/04/Mount-NFS-Shares.png) - -Check Available NFS Shares - -To mount NFS network shares on the local client using the command line on demand, use the following syntax: - - # mount -t nfs -o [options] remote_host:/remote/directory /local/directory - -which, in our case, translates to: - - # mount -t nfs 192.168.0.10:/NFS-SHARE /mnt/nfs - -If you get the following error message: “Job for rpc-statd.service failed. See “systemctl status rpc-statd.service” and “journalctl -xn” for details.”, make sure the rpcbind service is enabled and started in your system first: - - # systemctl enable rpcbind.socket - # systemctl restart rpcbind.service - -and then reboot. That should do the trick and you will be able to mount your NFS share as explained earlier. If you need to mount the NFS share automatically on system boot, add a valid entry to the /etc/fstab file: - - remote_host:/remote/directory /local/directory nfs options 0 0 - -The variables remote_host, /remote/directory, /local/directory, and options (which is optional) are the same ones used when manually mounting an NFS share from the command line. As per our previous example: - - 192.168.0.10:/NFS-SHARE /mnt/nfs nfs defaults 0 0 - -#### Mounting CIFS (Samba) Network Shares #### - -Samba represents the tool of choice to make a network share available in a network with *nix and Windows machines. To show the Samba shares that are available, use the smbclient command with the -L flag, followed by the machine name or its IP address. This tool is included in the samba-client package: - -You will be prompted for root’s password in the remote host: - - # smbclient -L 192.168.0.10 - -![Check Samba Shares](http://www.tecmint.com/wp-content/uploads/2015/04/Check-Samba-Shares.png) - -Check Samba Shares - -To mount Samba network shares on the local client you will need to install first the cifs-utils package: - - # yum update && yum install cifs-utils - -Then use the following syntax on the command line: - - # mount -t cifs -o credentials=/path/to/credentials/file //remote_host/samba_share /local/directory - -which, in our case, translates to: - - # mount -t cifs -o credentials=~/.smbcredentials //192.168.0.10/gacanepa /mnt/samba - -where smbcredentials: - - username=gacanepa - password=XXXXXX - -is a hidden file inside root’s home (/root/) with permissions set to 600, so that no one else but the owner of the file can read or write to it. - -Please note that the samba_share is the name of the Samba share as returned by smbclient -L remote_host as shown above. - -Now, if you need the Samba share to be available automatically on system boot, add a valid entry to the /etc/fstab file as follows: - - //remote_host:/samba_share /local/directory cifs options 0 0 - -The variables remote_host, /samba_share, /local/directory, and options (which is optional) are the same ones used when manually mounting a Samba share from the command line. Following the definitions given in our previous example: - - //192.168.0.10/gacanepa /mnt/samba cifs credentials=/root/smbcredentials,defaults 0 0 - -### Conclusion ### - -In this article we have explained how to set up ACLs in Linux, and discussed how to mount CIFS and NFS network shares in a RHEL 7 client. - -I recommend you to practice these concepts and even mix them (go ahead and try to set ACLs in mounted network shares) until you feel comfortable. If you have questions or comments feel free to use the form below to contact us anytime. Also, feel free to share this article through your social networks. - --------------------------------------------------------------------------------- - -via: http://www.tecmint.com/rhcsa-exam-configure-acls-and-mount-nfs-samba-shares/ - -作者：[Gabriel Cánepa][a] -译者：[译者ID](https://github.com/译者ID) -校对：[校对者ID](https://github.com/校对者ID) - -本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出 - -[a]:http://www.tecmint.com/author/gacanepa/ -[1]:http://www.tecmint.com/rhcsa-exam-create-format-resize-delete-and-encrypt-partitions-in-linux/ -[2]:http://www.tecmint.com/rhcsa-exam-manage-users-and-groups/ -[3]:https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Storage_Administration_Guide/ch-acls.html From b663886aa6da8c94947f11a0a901b56a3bba60a1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=99=BD=E5=AE=A6=E6=88=90?= Date: Fri, 28 Aug 2015 10:41:26 +0800 Subject: [PATCH 6/6] Delete RHCSA Series--Part 07--Using ACLs (Access Control Lists) and Mounting Samba or NFS Shares.md --- ...Lists) and Mounting Samba or NFS Shares.md | 192 ------------------ 1 file changed, 192 deletions(-) delete mode 100644 translated/tech/RHCSA/RHCSA Series--Part 07--Using ACLs (Access Control Lists) and Mounting Samba or NFS Shares.md diff --git a/translated/tech/RHCSA/RHCSA Series--Part 07--Using ACLs (Access Control Lists) and Mounting Samba or NFS Shares.md b/translated/tech/RHCSA/RHCSA Series--Part 07--Using ACLs (Access Control Lists) and Mounting Samba or NFS Shares.md deleted file mode 100644 index a9c56b1cbe..0000000000 --- a/translated/tech/RHCSA/RHCSA Series--Part 07--Using ACLs (Access Control Lists) and Mounting Samba or NFS Shares.md +++ /dev/null @@ -1,192 +0,0 @@ -[xiqingongzi Translating] -RHCSA Series: Using ACLs (Access Control Lists) and Mounting Samba / NFS Shares – Part 7 -================================================================================ -在第六篇文章的最后，我们开始解释如何使用parted和SSM 设置和配置本地文件存储([RHCSA series Part 6][1]) - -![Configure ACL's and Mounting NFS / Samba Shares](http://www.tecmint.com/wp-content/uploads/2015/04/Configure-ACLs-and-Mounting-NFS-Samba-Shares.png) - -RHCSA系列：：第七章 ACL的配置和安装NFS/Samba文件分享系统 - -我们还讨论了如何创建和在启动启动时用密码挂载加密逻辑卷。另外，我们要提醒您要避免在安装 在管理操作系统的存储文件系统事执行关键的操作。接下来我们要回顾在红帽Linux 7 中常用的文件系统格式然后卸载和挂载网络文件系统（CIFS和NFS）， -#### 前提 #### - -在开始之前，请确保你有一个线上Samba服务器和一个线上NFS服务器（RHEL7 将很快不支持 NFS V2） - -在这个指南中,我们将使用一个IP为192.168.0.10的机器作为服务端，RHEL7 盒子作为客户端，IP为192.168.0.18，稍后我们会告诉你该安装哪些软件包。 - -### RHEL7中的文件格式 ### - -从RHEL7 开始，XFS 因为其高可用性和可拓展性被设置为所有架构的默认文件系统。目前，红帽和合作伙伴测试的主流硬件线上他支持最大500TB 每个文件系统。 -同时，XFS使user_xattr（扩展用户属性）和ACL（POSIX访问控制列表）作为默认的挂载选项，不像ext3或ext4（ext2在RHEL 7中是过时的），这意味着你不需要明确的指定命令行选项或在/etc/fstab挂载时XFS文件系统（如果你想禁用在后一种情况下，这样的选择你要明确使用no_acl和no_user_xattr）。 -记住，扩展用户属性可以指定文件和目录用于存储任意等附加信息的MIME类型，字符集或文件的编码，而对用户属性的访问权限由普通文件权限位的定义。 -#### 权限控制列表 #### - -每一个系统管理员，无论新手还是专家，都熟悉文件和目录的权限和许可。它能制定特定的权限(读，写和执行)的所有者，属组，和其他的正常访问权限。如果需要，可以回去看看 [Part 3 of the RHCSA series][2] -然而，由于标准的 ugo/rwx 设置不允许配置不同用户不同权限，所以ACL可以比一般规定更多的文件和目录权限。 -事实上，ACL定义的权限是文件权限的一个超集，我们来看一下在真正的场景下是如何转换的。 -1. 有两种类型：访问ACL (可以适用于任何一个特定的文件或目录），也是默认的ACL，它只能应用于目录。如果文件包含在其中没有ACL设置，他们继承父目录的默认ACL。 -2. 首先，ACL可以配置每个用户，每个组，或不在组内的用户拥有文件。 -3。设置ACL（和删除）使用setfacl，分别使用M或X选项。 -例如，让我们创建一个组名为tecmint和添加用户johndoe和davenull： - # groupadd tecmint - # useradd johndoe - # useradd davenull - # usermod -a -G tecmint johndoe - # usermod -a -G tecmint davenull - -让我们确认用户属于组tecmint： - - # id johndoe - # id davenull - -![Verify Users](http://www.tecmint.com/wp-content/uploads/2015/04/Verify-Users.png) - -验证用户 - -Let’s now create a directory called playground within /mnt, and a file named testfile.txt inside. We will set the group owner to tecmint and change its default ugo/rwx permissions to 770 (read, write, and execute permissions granted to both the owner and the group owner of the file): -现在让我们创建一个在/mnt下的目录名为playground，和一个名叫testfile.txt文件。我们将tecmint和更改其默认 ugo/rwx 权限为 770组所有者（读，写，和执行给予属主和属组所有者权限）： - # mkdir /mnt/playground - # touch /mnt/playground/testfile.txt - # chmod 770 /mnt/playground/testfile.txt - -然后切换用户johndoe和davenull，按照这个顺序，并写入文件： - - echo "My name is John Doe" > /mnt/playground/testfile.txt - echo "My name is Dave Null" >> /mnt/playground/testfile.txt - -到目前为止很好。现在，让我们的用户gacanepa写入文件–和写操作，可以预料到出现的结果。 - -但如果我们真的需要用户gacanepa（不是tecmint组的成员）有/mnt/playground/testfile.txt的写入权限。首先，可能是你的想法是添加用户帐户组tecmint。但这会给他写上所有文件的权限，写入的是该组的权限，我们不希望这样。我们只希望他能写/mnt/playground/ testfile.txt。 - - # touch /mnt/playground/testfile.txt - # chown :tecmint /mnt/playground/testfile.txt - # chmod 777 /mnt/playground/testfile.txt - # su johndoe - $ echo "My name is John Doe" > /mnt/playground/testfile.txt - $ su davenull - $ echo "My name is Dave Null" >> /mnt/playground/testfile.txt - $ su gacanepa - $ echo "My name is Gabriel Canepa" >> /mnt/playground/testfile.txt - -![Manage User Permissions](http://www.tecmint.com/wp-content/uploads/2015/04/User-Permissions.png) - -管理用户权限 - -让我们给用户gacanepa添加/mnt/playground/testfile.txt的读写权限 -在root下执行 - - # setfacl -R -m u:gacanepa:rwx /mnt/playground - -您已经成功添加了一个ACL允许gacanepa写入测试文件。然后切换到用户gacanepa试图写入文件： - - $ echo "My name is Gabriel Canepa" >> /mnt/playground/testfile.txt - -要查看特定的文件或目录的ACL，使用getfacl： - - # getfacl /mnt/playground/testfile.txt - -![Check ACLs of Files](http://www.tecmint.com/wp-content/uploads/2015/04/Check-ACL-of-File.png) - -检查文件的ACLs - -设置默认ACL目录（它的内容将会继承除非被覆盖），添加d:以前的规则并且指定一个文件名来替代 - # setfacl -m d:o:r /mnt/playground - -以上的ACL将允许用户不在属组属主有/mnt/playground的读权限。注意在getfacl /mnt/playground 之前和之后的改变输出的差异： -![Set Default ACL in Linux](http://www.tecmint.com/wp-content/uploads/2015/04/Set-Default-ACL-in-Linux.png) - -Set Default ACL in Linux - -[Chapter 20 in the official RHEL 7 Storage Administration Guide][3] 提供了更多ACL的例子，我强烈推荐你去读读它，参考起来非常方便。 - -#### 安装NFS网络共享 #### - -显示在你的服务器的NFS共享可用的列表，您可以使用showmount命令与E选项，其次是机器名或IP地址。这个工具包含在NFS utils包： - - # yum update && yum install nfs-utils - -然后: - - # showmount -e 192.168.0.10 - -你会得到一个列表的可用的NFS分享192.168.0.10： -![Check Available NFS Shares](http://www.tecmint.com/wp-content/uploads/2015/04/Mount-NFS-Shares.png) - -Check Available NFS Shares - -在使用命令行对必要的本地客户端挂载NFS网络共享，使用以下语法： - - # mount -t nfs -o [options] remote_host:/remote/directory /local/directory - -在我们的例子中，翻译成： - - # mount -t nfs 192.168.0.10:/NFS-SHARE /mnt/nfs - -如果您收到一下错误消息:"rpc-statd.service工作失败,看 “systemctl status rpc-statd.service” 和“journalctl -xn” 获取详细信息.确保你的rpcbind服务在开机时开启。 - # systemctl enable rpcbind.socket - # systemctl restart rpcbind.service - -然后重新启动。这应该做的技巧，你将能够挂载NFS共享就和前面所解释的那样。如果你需要安装NFS共享的自动引导系统，添加一个有效的条目到/etc/fstab文件： - - 远程主机:远程目录 本地目录 nfs 选项 0 0 - -变量远程主机, 远程目录, 本地目录, and 选项 (可选的)在我们手动挂载是谁同样的，就和我们之前的例子一样。 - - 192.168.0.10:/NFS-SHARE /mnt/nfs nfs defaults 0 0 - -#### 挂载 Samba 网络文件共享 #### - -Samba 代表选择可以在×nix和Windows之间进行网络共享的工具.使用Samba客户端包内的 smbclient 命令 加 -L 参数来展示 Samba 文件分享，其次是机器名或IP地址 -将会提示你输入远程主机上的密码: - # smbclient -L 192.168.0.10 - -![Check Samba Shares](http://www.tecmint.com/wp-content/uploads/2015/04/Check-Samba-Shares.png) - -Check Samba Shares - -在本地客户端，你需要首先安装CIFS utils来挂载Samba： - - # yum update && yum install cifs-utils - -然后在命令行上使用下面的语法： - - # mount -t cifs -o credentials=/path/to/credentials/file //remote_host/samba_share /local/directory - -在我们的例子中，翻译成： - - # mount -t cifs -o credentials=~/.smbcredentials //192.168.0.10/gacanepa /mnt/samba - -smbcredentials内容为: - - username=gacanepa - password=XXXXXX - -是一个隐藏文件在root的主目录（/root/），权限设置为600，因此，除了该文件的所有者可以读或写，没有人能够读写。 -请注意，samba_share是Samba共享的名字就像 smbclient -L remote_host 返回的那样 - -现在，如果你需要samba共享可自动在系统启动时，添加一个有效的条目/etc/fstab文件如下： - - //远程主机:/samba_share 本地目录 cifs 选项 0 0 - -变量 远程主机, /samba_share, 本地目录, 选项 (可选的) 和我们手动安装的意义一样 - - //192.168.0.10/gacanepa /mnt/samba cifs credentials=/root/smbcredentials,defaults 0 0 - -### 结论 ### - -在这篇文章中我们已经讲解了如何在Linux设置ACL，并探讨RHEL7中该如何挂载CIFS和NFS网络共享。 -我建议你去实践这些概念，甚至把它们一起安装（先尝试安装网络共享设置ACL）如果你有疑问或意见，请随时使用下面的表格，随时与我们联系。还可以通过你的社交网络来分享这篇文章。 --------------------------------------------------------------------------------- - -via: http://www.tecmint.com/rhcsa-exam-configure-acls-and-mount-nfs-samba-shares/ - -作者：[Gabriel Cánepa][a] -译者：[xiqingongzi](https://github.com/xiqingongzi) -校对：[校对者ID](https://github.com/校对者ID) - -本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出 - -[a]:http://www.tecmint.com/author/gacanepa/ -[1]:http://www.tecmint.com/rhcsa-exam-create-format-resize-delete-and-encrypt-partitions-in-linux/ -[2]:http://www.tecmint.com/rhcsa-exam-manage-users-and-groups/ -[3]:https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Storage_Administration_Guide/ch-acls.html