精华区文章阅读

发信人: tcpip (高级草包), 信区: Linux
标题: 在samba中用NT的安全对话框来观察和改变UNIX权2限
发信站: 紫丁香 (Fri May 5 20:06:15 2000) WWW-POST

修改文件或目录的权限
---------------------------------------

Modifying file and directory permissions is as simple as changing the
displayed permissions in the dialog box, and clicking the OK button. However,
there are limitations that a user needs to be aware of, and also interactions
with the standard Samba permission masks and mapping of DOS attributes that
need to also be taken into account.

修改文件或目录的权限只要简单地在对话框中改好显示的权限然后点击OK按钮就可以了。
但是，用户要明白这样有一定的局限性，并且标准的samba权限掩码和DOS属性也需要交互
地设置到账号中。

If the parameter "nt acl support" is set to "false" then any attempt to set
security permissions will fail with an "Access Denied" message.

如果设定“nt acl support”参数为“false”的话，任何设置安全权限的尝试都会失败
并显示一个“Access Denied”信息。

The first thing to note is that the "Add" button will not return a list of
users in Samba 2.0.4 (it will give an error message of "The remote proceedure
call failed and did not execute"). This means that you can only manipulate
the current user/group/world permissions listed in the dialog box. This
actually works quite well as these are the only permissions that UNIX
actually has.

首先要注意的是在samb 2.0.4版本中“Add”按钮不会返回一份所有用户清单(它会给出“
The remote proceedure call failed and did not execute”远程过程调用失败不能执
行的错误信息)。这就是说你只能对在对话框中列出来的当前user/group/world权限进行
操作。当只拥有实际UNIX权限时，实际的操作会非常安静。

If a permission triple (either user, group, or world) is removed from the
list of permissions in the NT dialog box, then when the "OK" button is
pressed it will be applied as "no permissions" on the UNIX side. If you then
view the permissions again the "no permissions" entry will appear as the NT
"O" flag, as described above. This allows you to add permissions back to a
file or directory once you have removed them from a triple component.

如果在NT对话框中把三种权限(user、group、world中的任意一项)从权限列表中删除的话
，按“OK”按钮时会把“no permissions”应用到UNIX端。如果你再次查看权限时，“
no permissions”会象NT的“0”标志一样出现。这时你可以再次对文件或目录加入你从
三种权限中删除的那些权限。

As UNIX supports only the "r", "w" and "x" bits of an NT ACL then if other NT
security attributes such as "Delete access" are selected then they will be
ignored when applied on the Samba server.

UNIX只支持NT访问控制列表中的“r”“w”“x”位，所以如果选择其它NT安全属性象“
Delete access”的话，都会被samba服务器忽略。

When setting permissions on a directory the second set of permissions (in the
second set of parentheses) is by default applied to all files within that
directory. If this is not what you want you must uncheck the "Replace
permissions on existing files" checkbox in the NT dialog before clicking
"OK".

当在目录上设置权限时，权限标志中的第二部分被默认地应用到目录中的所有文件上。如
果你不希望这样的设置，可以在点击“OK”按钮前把NT对话框中的“Replace
permissions on existing files”选择框撤选掉。

If you wish to remove all permissions from a user/group/world component then
you may either highlight the component and click the "Remove" button, or set
the component to only have the special "Take Ownership" permission (dsplayed
as "O") highlighted.

如果你想从user/group/world成员中删除所有的权限，你可以选中成员然后点击“Remove
”按钮，或者设置成员只拥有特殊的“Take Ownership”权限(用0来显示)。

Interaction with the standard Samba create mask parameters

建立samba掩码参数
----------------------------------------------------------

Note that with Samba 2.0.5 there are four new parameters to control this
interaction.

注意在samba 2.0.5中有四个新参数可以控制这一交互操作。

These are :

它们是：

security mask force security mode directory security mask force directory
security mode

Once a user clicks "OK" to apply the permissions Samba maps the given
permissions into a user/group/world r/w/x triple set, and then will check the
changed permissions for a file against the bits set in the "security mask"
parameter. Any bits that were changed that are not set to '1' in this
parameter are left alone in the file permissions.

一旦用户应用了权限，samba会把权限映射到user/group/world中对应的r/w/x三项，然后
再次用security mask参数中设好的位来检查改变的文件权限。上面这个参数中位如果没
有改为“1”的话将会继续保留在文件的权限中。

Essentially, zero bits in the "security mask" mask may be treated as a set of
bits the user is not allowed to change, and one bits are those the user is
allowed to change.

本质上说，security mask中的位0掩码可以被视为不允许更改，而非0值则允许修改。

If not set explicitly this parameter is set to the same value as the "create
mask" parameter to provide compatibility with Samba 2.0.4 where this
permission change facility was introduced. To allow a user to modify all the
user/group/world permissions on a file, set this parameter to 0777.

如果没有明确设定，这个参数会使用与"create mask"参数相同的值以提供与samba 2.0.4
兼容。要允许用户修改文件的/user/group/world权限，把这个参数设为0777。

Next Samba checks the changed permissions for a file against the bits set in
the "force security mode" parameter. Any bits that were changed that
correspond to bits set to '1' in this parameter are forced to be set.

今后，samba会再一次以"force security mode"参数中设置的位来检查文件的更改权限。
任何更改过，并且与这个参数中设为1的位相对应的位都会被强制设定。

Essentially, bits set in the "force security mode" parameter may be treated
as a set of bits that, when modifying security on a file, the user has always
set to be 'on'.

本质上说，在"force security mode"参数中位的设定可以看成是一组当文件安全性更改
时，总是可以向用户提供'on'设置的位。

If not set explicitly this parameter is set to the same value as the "force
create mode" parameter to provide compatibility with Samba 2.0.4 where the
permission change facility was introduced. To allow a user to modify all the
user/group/world permissions on a file, with no restrictions set this
parameter to 000.

如果没有明确设定，这个参数会使用与"force create mode"参数相同的值以提供与
samba 2.0.4兼容。要允许用户修改文件的/user/group/world权限，不要把这个参数设为
000。

The "security mask" and "force security mode" parameters are applied to the
change request in that order.

"security mask"和"force security mode"这两个参数被应用于按以上的次序改变操作请
求。

For a directory Samba will perform the same operations as described above for
a file except using the parameter "directory security mask" instead of
"security mask", and "force directory security mode" parameter instead of
"force security mode".

对于目录，samba会执行同以上对文件的对应描述相同的操作，除了用参数"directory
security mask"和"force directory security mode"来分别替换掉"security mask"和
"force security mode"。

The "directory security mask" parameter by default is set to the same value
as the "directory mask" parameter and the "force directory security mode"
parameter by default is set to the same value as the "force directory mode"
parameter to provide compatibility with Samba 2.0.4 where the permission
change facility was introduced.

"directory security mask"参数默认被设成与"directory mask"参数相同的值，而
"force directory security mode"参数则被设成与"force directory mode"参数相同的
值以提供对samba 2.0.4的兼容。

In this way Samba enforces the permission restrictions that an administrator
can set on a Samba share, whilst still allowing users to modify the
permission bits within that restriction.

samba以这种方法来加强管理员可以在共享资源上设制的权限限制，同时也允许用户用这
样的限制机制来修改自己的权限位。

If you want to set up a share that allows users full control in modifying the
permission bits on their files and directories and doesn't force any
particular bits to be set 'on', then set the following parameters in the
smb.conf.5 file in that share specific section :

如果你要在一个共享资源上设定允许用户完全控制这些资源，只要在他们的文件和目录的
权限位上作修改，并且不要强制任何特殊的位为'on'，在smb.conf.5文件的共享资源描述
部分设定以下的参数：

security mask = 0777 force security mode = 0 directory security mask = 0777
force directory security mode = 0

As described, in Samba 2.0.4 the parameters :

这里再说一下，samba 2.0.4中这些参数：

create mask force create mode directory mask force directory mode

were used instead of the parameters discussed here.

在用作替换时还需要得到论证。

Interaction with the standard Samba file attribute mapping

与标准的samba文件属性映射作交互
----------------------------------------------------------

Samba maps some of the DOS attribute bits (such as "read only") into the UNIX
permissions of a file. This means there can be a conflict between the
permission bits set via the security dialog and the permission bits set by
the file attribute mapping.

samba会映射一些DOS属性位(如“只读”)到unix文件的权限。这就是说通过安全性对话框
设定权限位时会有一个冲突，因为权限位已经由文件属性映射操作时被设置过了。

One way this can show up is if a file has no UNIX read access for the owner
it will show up as "read only" in the standard file attributes tabbed dialog.
Unfortunately this dialog is the same one that contains the security info in
another tab.

通过这样，可以在文件对其属主来说没有unix读访问权限时，在对话框的标准文件属性栏
中显示“只读” 。不幸的是，这个对话框在其它栏位中也包含有这样的安全性信息。
What this can mean is that if the owner changes the permissions to allow
themselves read access using the security dialog, clicks "OK" to get back to
the standard attributes tab dialog, and then clicks "OK" on that dialog, then
NT will set the file permissions back to read-only (as that is what the
attributes still say in the dialog). This means that after setting
permissions and clicking "OK" to get back to the attributes dialog you should
always hit "Cancel" rather than "OK" to ensure that your changes are not
overridden.

这样的操作说明了如果文件属主更变过权限，允许他人进行读访问时，只要用安全对话框
，点“OK”返回到标准属性页对话框，并在这里点“OK”的话，NT将把文件权限设回只读
(就象属性在对话框中提示的那样)。这说明了在设定好权限并点“OK”返回属性对话框后
，你应该一直用“Cancel”来确保你的改变不被覆盖，而不是用“OK”按钮
--
"这一千多年没写诗了?"
"写了, 不过只写了两句."
"千年得两句, 一定是万古丽句了. 念来听听."
"好吧, 我现丑了" 太白星清了清嗓子, 浑厚的男中音在天庭响起:
大海啊, 都是水;
骏马啊, 四条腿;

※ 来源:·紫丁香 bbs.hit.edu.cn·[FROM: freesrc.hit.edu]

Linux 版 (精华区)