feat: samba

Dockerfile

@@ -2,4 +2,33 @@ FROM snowdreamtech/alpine:3.20.0
 
 LABEL maintainer="snowdream <[email protected]>"
 
+ENV SAMBA_ROOT_PASSWORD=
+
 RUN apk add --no-cache samba
+
+# exposes samba's default ports 
+# 
+# https://wiki.samba.org/index.php/Samba_AD_DC_Port_Usage
+# 
+# Service	Port	Protocol
+# DNS *	53	tcp/udp
+# Kerberos	88	tcp/udp
+# ntp **	123	udp
+# End Point Mapper (DCE/RPC Locator Service)	135	tcp
+# NetBIOS Name Service	137	udp
+# NetBIOS Datagram	138	udp
+# NetBIOS Session	139	tcp
+# LDAP	389	tcp/udp
+# SMB over TCP	445	tcp
+# Kerberos kpasswd	464	tcp/udp
+# LDAPS ***	636	tcp
+# Global Catalog	3268	tcp
+# Global Catalog SSL ***	3269	tcp
+# Dynamic RPC Ports ****	49152-65535	tcp
+EXPOSE 135/tcp 137/udp 138/udp 139/tcp 389/tcp 445/TCP
+
+COPY smb.conf /etc/samba/
+
+COPY docker-entrypoint.sh /usr/local/bin/
+
+ENTRYPOINT ["docker-entrypoint.sh"]

README.md

@@ -5,13 +5,20 @@
 Docker Image packaging for Samba. (amd64, arm32v6, arm32v7, arm64v8, i386, ppc64le,riscv64, s390x)
 
 # Run
+```bash
+docker run -d --restart always --network host -e SAMBA_ROOT_PASSWORD=123456 --name samba snowdreamtech/samba:latest
+```
+
+```bash
+docker run -d --restart always --network host -e TZ=Asia/Shanghai -e SAMBA_ROOT_PASSWORD=123456 --name samba snowdreamtech/samba:latest
+```
 
 ```bash
-docker run snowdreamtech/samba:latest
+docker run -d --restart always -e SAMBA_ROOT_PASSWORD=123456 -p 137:137/udp -p 138:138/udp -p 139:139/tcp -p 445:445/tcp --name samba snowdreamtech/samba:latest
 ```
 
 ```bash
-docker run -e TZ=Asia/Shanghai snowdreamtech/samba:latest
+docker run -d --restart always -e TZ=Asia/Shanghai -e SAMBA_ROOT_PASSWORD=123456 -p 137:137/udp -p 138:138/udp -p 139:139/tcp -p 445:445/tcp --name samba snowdreamtech/samba:latest
 ```
 
 # Development

docker-entrypoint.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+set -e
+
+# change the samba password for root
+echo -e "$SAMBA_ROOT_PASSWORD\n$SAMBA_ROOT_PASSWORD" | smbpasswd -a -s root > /dev/null 2>&1
+
+# start samba
+/usr/sbin/smbd -D -F -s /etc/samba/smb.conf
+
+# wait
+wait

smb.conf

@@ -0,0 +1,29 @@
+[global]
+    netbios name = alpinesmbd
+    workgroup = WORKGROUP
+    server string = Samba %v in an Alpine Linux Docker container
+    security = user
+    guest account = nobody
+    map to guest = Bad User
+
+    # for security reasons you shouldn't allow any version below SMB2
+    # if you're running ancient Windows (< 7) or other clients, you can check their supported protocol versions here:
+    # https://www.samba.org/samba/docs/4.8/man-html/smb.conf.5.html#SERVERMAXPROTOCOL
+    server min protocol = SMB2
+
+    # disable printing services
+    load printers = no
+    printing = bsd
+    printcap name = /dev/null
+    disable spoolss = yes
+
+[home]
+    comment = root's home
+    path = /root
+    valid users = root
+    invalid users = 
+    read list = root
+    write list = root 
+    # getting rid of those annoying .DS_Store files created by Mac users...
+    veto files = /._*/.DS_Store/
+    delete veto files = yes

smb.full.conf

@@ -0,0 +1,237 @@
+# This is the main Samba configuration file. You should read the
+# smb.conf(5) manual page in order to understand the options listed
+# here. Samba has a huge number of configurable options (perhaps too
+# many!) most of which are not shown in this example
+#
+# For a step to step guide on installing, configuring and using samba,
+# read the Samba-HOWTO-Collection. This may be obtained from:
+#  http://www.samba.org/samba/docs/Samba-HOWTO-Collection.pdf
+#
+# Many working examples of smb.conf files can be found in the
+# Samba-Guide which is generated daily and can be downloaded from:
+#  http://www.samba.org/samba/docs/Samba-Guide.pdf
+#
+# Any line which starts with a ; (semi-colon) or a # (hash)
+# is a comment and is ignored. In this example we will use a #
+# for commentry and a ; for parts of the config file that you
+# may wish to enable
+#
+# NOTE: Whenever you modify this file you should run the command "testparm"
+# to check that you have not made any basic syntactic errors.
+#
+#======================= Global Settings =====================================
+[global]
+
+# workgroup = NT-Domain-Name or Workgroup-Name, eg: MIDEARTH
+   workgroup = MYGROUP
+
+# server string is the equivalent of the NT Description field
+   server string = Samba Server
+
+# Server role. Defines in which mode Samba will operate. Possible
+# values are "standalone server", "member server", "classic primary
+# domain controller", "classic backup domain controller", "active
+# directory domain controller".
+#
+# Most people will want "standalone server" or "member server".
+# Running as "active directory domain controller" will require first
+# running "samba-tool domain provision" to wipe databases and create a
+# new domain.
+   server role = standalone server
+
+# This option is important for security. It allows you to restrict
+# connections to machines which are on your local network. The
+# following example restricts access to two C class networks and
+# the "loopback" interface. For more examples of the syntax see
+# the smb.conf man page
+;   hosts allow = 192.168.1. 192.168.2. 127.
+
+# Uncomment this if you want a guest account, you must add this to /etc/passwd
+# otherwise the user "nobody" is used
+;  guest account = pcguest
+
+# this tells Samba to use a separate log file for each machine
+# that connects
+   log file = /var/log/samba/%m.log
+
+# Put a capping on the size of the log files (in Kb).
+   max log size = 50
+
+# Specifies the Kerberos or Active Directory realm the host is part of
+;   realm = MY_REALM
+
+# Backend to store user information in. New installations should
+# use either tdbsam or ldapsam. smbpasswd is available for backwards
+# compatibility. tdbsam requires no further configuration.
+;   passdb backend = tdbsam
+
+# Using the following line enables you to customise your configuration
+# on a per machine basis. The %m gets replaced with the netbios name
+# of the machine that is connecting.
+# Note: Consider carefully the location in the configuration file of
+#       this line.  The included file is read at that point.
+;   include = /etc/samba/smb.%m.conf
+
+# Configure Samba to use multiple interfaces
+# If you have multiple network interfaces then you must list them
+# here. See the man page for details.
+;   interfaces = 192.168.12.2/24 192.168.13.2/24
+
+# Where to store roving profiles (only for Win95 and WinNT)
+#        %L substitutes for this servers netbios name, %U is username
+#        You must uncomment the [Profiles] share below
+;   logon path = \\%L\Profiles\%U
+
+# Windows Internet Name Serving Support Section:
+# WINS Support - Tells the NMBD component of Samba to enable it's WINS Server
+;   wins support = yes
+
+# WINS Server - Tells the NMBD components of Samba to be a WINS Client
+#	Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
+;   wins server = w.x.y.z
+
+# WINS Proxy - Tells Samba to answer name resolution queries on
+# behalf of a non WINS capable client, for this to work there must be
+# at least one	WINS Server on the network. The default is NO.
+;   wins proxy = yes
+
+# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
+# via DNS nslookups. The default is NO.
+   dns proxy = no
+
+# These scripts are used on a domain controller or stand-alone
+# machine to add or delete corresponding unix accounts
+;  add user script = /usr/sbin/useradd %u
+;  add group script = /usr/sbin/groupadd %g
+;  add machine script = /usr/sbin/adduser -n -g machines -c Machine -d /dev/null -s /bin/false %u
+;  delete user script = /usr/sbin/userdel %u
+;  delete user from group script = /usr/sbin/deluser %u %g
+;  delete group script = /usr/sbin/groupdel %g
+
+# Enable usershares to give non-root users the capability to add, modify and
+# delete their own share definitions. See smb.conf(5).
+# To enable this, do:
+#
+#   addgroup -S sambashare
+#   mkdir /var/lib/samba/usershares
+#   chown root:sambashare /var/lib/samba/usershares
+#   chmod 1770 /var/lib/samba/usershares
+#
+# and uncomment the lines below
+;  usershare path = /var/lib/samba/usershares
+;  usershare max shares = 100
+;  usershare allow guests = yes
+;  usershare owner only = yes
+
+#============================ Share Definitions ==============================
+[homes]
+   comment = Home Directories
+   browsable = no
+   writable = yes
+
+# Un-comment the following and create the netlogon directory for Domain Logons
+; [netlogon]
+;   comment = Network Logon Service
+;   path = /usr/local/samba/lib/netlogon
+;   guest ok = yes
+;   writable = no
+;   share modes = no
+
+
+# Un-comment the following to provide a specific roving profile share
+# the default is to use the user's home directory
+;[Profiles]
+;    path = /usr/local/samba/profiles
+;    browsable = no
+;    guest ok = yes
+
+
+# NOTE: If you have a BSD-style print system there is no need to
+# specifically define each individual printer
+[printers]
+   comment = All Printers
+   path = /usr/spool/samba
+   browsable = no
+# Change 'guest ok' from 'no' to 'yes' to allow the 'guest account' user to print
+   guest ok = no
+   writable = no
+   printable = yes
+
+# This one is useful for people to share files
+;[tmp]
+;   comment = Temporary file space
+;   path = /tmp
+;   read only = no
+;   public = yes
+
+# A publicly accessible directory, but read only, except for people in
+# the "staff" group
+;[public]
+;   comment = Public Stuff
+;   path = /home/samba
+;   public = yes
+;   writable = no
+;   printable = no
+;   write list = @staff
+
+# Other examples.
+#
+# A private printer, usable only by fred. Spool data will be placed in fred's
+# home directory. Note that fred must have write access to the spool directory,
+# wherever it is.
+;[fredsprn]
+;   comment = Fred's Printer
+;   valid users = fred
+;   path = /homes/fred
+;   printer = freds_printer
+;   public = no
+;   writable = no
+;   printable = yes
+
+# A private directory, usable only by fred. Note that fred requires write
+# access to the directory.
+;[fredsdir]
+;   comment = Fred's Service
+;   path = /usr/somewhere/private
+;   valid users = fred
+;   public = no
+;   writable = yes
+;   printable = no
+
+# a service which has a different directory for each machine that connects
+# this allows you to tailor configurations to incoming machines. You could
+# also use the %U option to tailor it by user name.
+# The %m gets replaced with the machine name that is connecting.
+;[pchome]
+;  comment = PC Directories
+;  path = /usr/pc/%m
+;  public = no
+;  writable = yes
+
+# A publicly accessible directory, read/write to all users. Note that all files
+# created in the directory by users will be owned by the default user, so
+# any user with access can delete any other user's files. Obviously this
+# directory must be writable by the default user. Another user could of course
+# be specified, in which case all files would be owned by that user instead.
+;[public]
+;   path = /usr/somewhere/else/public
+;   public = yes
+;   only guest = yes
+;   writable = yes
+;   printable = no
+
+# The following two entries demonstrate how to share a directory so that two
+# users can place files there that will be owned by the specific users. In this
+# setup, the directory should be writable by both users and should have the
+# sticky bit set on it to prevent abuse. Obviously this could be extended to
+# as many users as required.
+;[myshare]
+;   comment = Mary's and Fred's stuff
+;   path = /usr/somewhere/shared
+;   valid users = mary fred
+;   public = no
+;   writable = yes
+;   printable = no
+;   create mask = 0765
+
+