SAMBA SERVER SETUP WITH RHEL6: 2013

Introduction

FTP stand for File Transfer Protocol, it is used for transferring files from one location to another location on internet. This is very simple protocol to configure. FTP following server/client architecture. In Red Hat System, vsftpd is the package which used to configure FTP server. VSFTPD is a short name for Very Secured FTP Daemon.

Configuration files:

Ø Configuration file: /etc/vsftpd/vsftpd.conf

Ø Port: 20 (Data Transfer) & 21 (Connection)

Ø Daemon: vsftpd

Ø Script: /etc/init.d/vsftpd

Ø Log File: /var/log/vsftpd.log

Following are the task that we will learn to do:

1. FTP server installation on Red Hat Enterprise Linux Version 6

2. Allowing Local Users login

3. Allowing users /home directory access

4. Download and Upload commands on FTP Server

5. Allowing file upload by “Anonymous” user

6. Running FTP server in “chroot” environment

7. Using files /etc/vsftpd/user_list and /etc/vsftpd/ftpusers to control access to FTP server

8. Restricting “Anonymous” login

1. FTP server installation on Red Hat Enterprise Linux Version 6

For FTP server configuration on RHEL 6, we will install vsftpd package using YUM. Following the below steps:

[root@astech ~]#yum install vsftpd

If you do not have YUM server configured, please click here

We can also install the vsftpd server with RPM command. For this, you must have the vsftpd package RPM on your system. You can find this package in Red Hat Enterprise Linux Version 6

CD/DVD. For this case, server CD/DVD is mounted on /media/RHEL_6.0 i386 Disc 1. Follow the steps below:

[root@astech ~]#cd /media/RHEL_6.0 i386 Disc 1/Packages

[root@astech Packages]# rpm -q vsftpd

vsftpd-2.2.2-6.el6.i686

[root@astech Packages]# rpm -ivh vsftpd-2.2.2-6.el6.i686.rpm

We have installed the vsftpd package successfully. We need to start the server and configure its service to auto start on system start up. Below are the steps:

[root@astech ~]#service vsftpd start

Starting vsftpd for vsftpd: [ OK ]

[root@astech ~]#chkconfig --level 35 vsftpd on

[root@astech ~]#

By default, FTP server is configured to allow login to a default user “anonymous”. When you have configured your FTP server, you can simply login with user “anonymous” without any password, just press “Enter” when prompted for password. Now, we will test our server by doing FTP to our own server as below:

[root@astech ~]# ftp localhost

Connected to localhost (127.0.0.1).

220 (vsFTPd 2.2.2)

Name (localhost:root): anonymous

331 Please specify the password.

Password:

230 Login successful.

Remote system type is UNIX.

Using binary mode to transfer files.

ftp>

2. Allowing Local Users login

To allow local user login to FTP server, we need to configure /etc/vsftpd/vsftpd.conf file and add below line:

[root@astech ~]#vim /etc/vsftpd/vsftpd.conf

local_enable=YES

Save the file and restart the vsftpd service with command:

[root@astech ~]# service vsftpd restart

Shutting down vsftpd: [ OK ]

Starting vsftpd for vsftpd: [ OK ]

[root@astech ~]#

To test this change, we will create a user name “abc” with password “abc” and will login to FTP server locally.

[root@astech ~]# useradd abc

[root@astech ~]# passwd abc

Changing password for user abc.

New password:

BAD PASSWORD: it is WAY too short

BAD PASSWORD: is too simple

Retype new password:

passwd: all authentication tokens updated successfully.

[root@astech ~]#

Now, we will login to FTP server:

[root@astech ~]# ftp localhost

Connected to localhost (127.0.0.1).

220 (vsFTPd 2.2.2)

Name (localhost:root): abc

331 Please specify the password.

Password:

230 Login successful.

Remote system type is UNIX.

Using binary mode to transfer files.

ftp>

Please note: In RHEL version 6 by default, you will not be able to run command “ftp”, you will need to install ftp rpm package to run this command. You can either install this package with YUM command or RPM command, both the procedures are given below. For RPM installation, you need to specify the package static path. In the below case, RPM package has been installed by entering the package directory:

[root@astech ~]#yum install ftp

Or you can install this with RPM command:

[root@astech ~]# cd /media/RHEL_6.0\ i386\ Disc\ 1/Packages/

[root@astech Packages]# rpm -q ftp

ftp-0.17-51.1.el6.i686

[root@astech Packages]# rpm -ivh ftp-0.17-51.1.el6.i686.rpm

3. Allowing users /home directory access

If you face an error “500 OOPS: cannot change directory:/home/abc”, then you need to make changes in your SeLinux and allow users to access their /home directory. First check if SeLinux allows users to access their /homedirectory with command “getsebool -a|grep ftp” and look for “ftp_home_dir --> off”, if this is “off” you need to change this to “on”. Follow the below steps:

[root@astech ~]#getsebool -a|grep ftp

allow_ftpd_anon_write --> off

allow_ftpd_full_access --> off

allow_ftpd_use_cifs --> off

allow_ftpd_use_nfs --> off

ftp_home_dir --> off

ftpd_connect_db --> off

httpd_enable_ftp_server --> off

sftpd_anon_write --> off

sftpd_enable_homedirs --> off

sftpd_full_access --> off

sftpd_write_ssh_home --> off

tftp_anon_write --> off

[root@astech ~]# setsebool ftp_home_dir=1

[root@astech ~]#

4. Download and Upload commands on FTP Server

To download from FTP server, we use “get” command whereas to upload a file to FTP server, we use “put” command. If you we have multiple file to download or upload, we can also use, “mget” and “mput” respectively.

ftp> get zsh-4.3.10-4.1.el6.i686.rpm

local: zsh-4.3.10-4.1.el6.i686.rpm remote: zsh-4.3.10-4.1.el6.i686.rpm

227 Entering Passive Mode (127,0,0,1,174,85).

150 Opening BINARY mode data connection for zsh-4.3.10-4.1.el6.i686.rpm (2207928 bytes).

226 Transfer complete.

2207928 bytes received in 0.437 secs (5057.61 Kbytes/sec)

ftp>

5. Allowing File Upload by “Anonymous” user

Assuming you already have a basic FTP server working, if not please follow step one. Now, make sure you have added these lines in your FTP configuration file /etc/vsftpd/vsftpd/conf:

write_enable=YES

anon_upload_enable=YES

anon_mkdir_write_enable=YES

Now, we will create a new folder under /var/ftp with name “upload” and will change its permission to allow full permission to “user” and “group” and read and execute permission to “others”:

[root@astech ~]# mkdir /var/ftp/upload

[root@astech ~]# chmod 773 /var/ftp/upload/

Now, we will change the SeLinux security context of the folder /var/ftp/upload. First, we will check security context of the file with command “ls –ldZ foldername”. Then, we will change it with command “chcon” as shown below:

[root@astech ~]#ls -ldZ /var/ftp/upload/

drwxrwx-wx. root root unconfined_u:object_r:public_content_t:s0 /var/ftp/upload/

[root@astech ~]#chcon -t public_content_rw_t /var/ftp/upload/

[root@astech ~]#

We will now allow “anonymous” user to write in the directory with following command:

[root@astech ~]# getsebool -a|grep ftp

allow_ftpd_anon_write --> off

[root@astech ~]# setsebool -P allow_ftpd_anon_write on

[root@astech ~]#

Now, restart the vsftpd server with “service vsftpd restart” command, that’s done! Below, we will test our configuration by uploading a file “install.log” to /var/ftp/upload folder with “anonymous” user login:

[root@astech ~]# ftp localhost

Connected to localhost (127.0.0.1).

220 (vsFTPd 2.2.2)

Name (localhost:root): anonymous

331 Please specify the password.

Password:

230 Login successful.

Remote system type is UNIX.

Using binary mode to transfer files.

ftp> cd upload

250 Directory successfully changed.

ftp> put install.log

local: install.log remote: install.log

227 Entering Passive Mode (127,0,0,1,234,203).

150 Ok to send data.

226 Transfer complete.

49454 bytes sent in 0.000331 secs (149407.86 Kbytes/sec)

ftp>

Now, the anonymous user can upload files to /var/ftp/upload folder. However, this user will not be able to list the content of the folder.

6. Running FTP server in “chroot” environment

Running your FTP server in chroot environment is a good way to limit access of the users to their home directory only. When you allow a normal user to access FTP server, the user is able to access all files and folders. This might prove a security threat. Hence, running your FTP server in “chroot” environment is good option. To configure your FTP server inchroot environment, add the following change in /etc/vsftpd/vsftpd.conf file:

chroot_local_user=YES

Now, restart vsftpd daemon. That’s done. Now, every user will access to their own home directory only which means if there is a user named “abc”, then this user will be able to access only his home directory which is /home/abc.

There are 2 more parameters with “chroot”:

chroot_list_enable=YES

chroot_list_file=/etc/vsftpd/chroot_list

If you set chroot_list_enable to “YES”, that means, vsftpd will check the default file /etc/vsftpd/chroot_list and will allow users listed in this file to access FTP server without “chroot” environment. You will need to manually create the file “chroot_list”. Use command, “touch /etc/vsftpd/chroot_list”. Edit this file to mention users name who are allowed to access FTP server without “chroot” restriction. Restart the vsftpd daemon. That’s done!

7. Using files /etc/vsftpd/user_list and /etc/vsftpd/ftpusers to limit access to FTP server

/etc/vsftpd/ftpusers — This file can be used to disallow log into vsftpd. The default users listed in this file are root, bin, and daemon users, among others. A user name is added in this file on per line basis. Any user added to this file list will simply be denied access to FTP server.

/etc/vsftpd/user_list — This file can be used deny or allow access to FTP server depending on whether the userlist_deny directive is set to YES (default) or NO in /etc/vsftpd/vsftpd.conf.

If userlist_deny is set to NO, then users listed in /etc/vsftpd/user_list will be allowed access.And if userlist_deny is set to YES, then users listed in /etc/vsftpd/user_list will not be allowed access to FTP server.

Please note if you use /etc/vsftpd/user_list to grant access to users, the usernames listed in /etc/vsftpd/user_list must not be listed in/etc/vsftpd/ftpusers file.

samba server configuration in rhel5

Samba is a suite of utilities that allows your Linux Machines to share files and other resources.
such as printers with Windows Machines.

Before configuring Samba server in Linux you need to have the following Pre-requests.

1. Linux System with network Configured

Here i was configured My IP as 192.168.10.111

2. Windows System with network configured in Same network.
here my System is having 192.168.10.108

3.Your Linux System firewall should be disabled.

Main Configuration:

1. Check your linux system wheather the samba package is installed or not with the following command.

[root@localhost ~]# rpm -qa samba*

2. If the packages are not installed in your system, use the following command to install from the internet.

[root@localhost ~]# yum install samba*

Note: Above command is for installing the packages from the internet only. So you should have the internet connection.

3. After installing the Packages

   Make sure that xinetd and Portmap service should be run.
   For checking those services are running or not, use the following commands.

   [root@localhost ~]# /etc/init.d/xinetd status

   [root@localhost ~]# /etc/init.d/portmap status

For starting the above service use the following services use the following commands.

[root@localhost ~]# /etc/init.d/xinetd restart

[root@localhost ~]# /etc/init.d/portmap restart

After that Make sure that these services to be run completely. For that use the following commands.

   [root@localhost ~]# chkconfig xinetd on

   [root@localhost ~]# chkconfig portmap on
    Check the services is running or not. These services should be running condition.

4. Create 2 users in your linux System i.e: sri and Gani

   [root@localhost ~]# useradd sri
   [root@localhost ~]# passwd sri
   Changing password for user sri.
   New password:
   Retype new password:
   passwd: all authentication tokens updated successfully.

   [root@localhost ~]# useradd Gani
   [root@localhost ~]# passwd Gani
   Changing password for user Gani.
   New password:
   Retype new password:
   passwd: all authentication tokens updated successfully.

5. Now create the share directory. i.e which directory you want to share.

   Here iam creating directory called 'Sambashare' in the following Path. i.e /opt
   and give the full Permissions to the directory.

   [root@localhost ~]# mkdir /opt/sambashare/
   [root@localhost ~]# chmod 777 /opt/sambashare/
   [root@localhost ~]# ls -l /opt/
   total 360
   drwx------. 2 root root 16384 Feb 1 11:01 lost+found
   drwxrwxrwx 3 root root   4096 Feb 6 18:12 sambashare
   -rwxrwxrwx. 1 root root 344558 Jan 30 15:41 sysstat-10.0.3-1.i586.rpm

6. Now enter the configuration into following file. i.e /etc/samba/smb.conf
In the above file enter the following configuration. Here iam giving permission to one user only.

Add the configuration at end of the file.

   Note: Better to take the backup of the configuration file.

   [root@localhost ~]# vi /etc/samba/smb.conf

   # My Sharing directory
   [data]
       comment = personal share
       path    = /opt/sambashare
       public = no
       writable = yes
       printable = no
       browseable = yes
       write list = sri

     :wq!

     Use these to save the configuration file

      :wq!

7. Now add the user to the samba user's List

[root@localhost ~]# smbpasswd -a sri

   New SMB password:
   Retype new SMB password:
   Added user sri.
   [root@localhost ~]#

8. Now we did the all the configurations. so start the samba service and check its status.

   [root@localhost ~]# chkconfig smb on
   [root@localhost ~]# /etc/init.d/smb restart
   Shutting down SMB services:                                [ OK ]
   Starting SMB services:                                     [ OK ]
   [root@localhost ~]# /etc/init.d/smb status
   smbd (pid 3686) is running...

Client side configuration for Samba server.

1. Check from your windows System to samba server whether Ping command is working or not.

   Start--> run--> cmd --> Ping 192.168.10.111

   If you are getting ping with proper reply then your server is working fine or else check the network connectivity
   and Linux System firewall.

2. Now access your samba server in the following way.

Start --> Run --> \\192.168.10.111 -->Press enter. (Here IP address is your samba server IP address)