Samba, còpies de seguretat i RAID

Samba Security Levels and Configuration

Understanding the SMB (Server Message Block) protocol is essential for anyone managing Linux file sharing with Samba. The protocol defines several security levels that dictate how authentication is performed. The most granular level is share‑level security, where each shared resource requires its own password. This contrasts with user‑level, server‑level, and domain‑level security, which rely on a single credential for multiple resources.

Key Security Levels

• Share‑level: Each share has an independent password. Ideal for simple environments where users do not have individual accounts on the server.
• User‑level: Users authenticate once and can access any share they are authorized for.
• Server‑level: The client authenticates to the server, then the server handles access to individual shares.
• Domain‑level: Authentication is delegated to a Windows domain controller.

When configuring smb.conf, the security = share directive activates share‑level protection, ensuring that each share prompts for its own password.

Controlling Guest Access in Samba

Guest access allows users to connect to a share without providing credentials. This is useful for public directories, such as a /public folder that anyone on the network can read.

Important Parameter: guest ok

The guest ok = yes (or guest ok = true) line inside a share definition tells Samba that the share may be accessed anonymously. If the parameter is omitted or set to no, the client must supply a valid username and password.

[public]
   path = /srv/samba/public
   read only = no
   guest ok = yes
   force user = nobody
  

Other directives, such as hosts allow or valid users, restrict access based on IP ranges or specific usernames, but they do not control guest access directly.

Managing Access with valid users

Beyond guest access, administrators often need to limit which users can reach a particular share. The valid users parameter lists the accounts permitted to connect. It works in conjunction with the global security setting (usually user or domain).

[private]
   path = /srv/samba/private
   read only = no
   valid users = alice, bob
  

When a client attempts to connect, Samba checks the supplied credentials against this list. If the user is not listed, the connection is denied, regardless of other network‑level allowances.

Rsync: Powerful Incremental Backups

Rsync is a versatile tool for synchronizing files and creating backups. Its ability to transfer only changed data makes it ideal for both full and incremental backups.

Excluding Files by Extension

To skip all .txt files during a transfer, use the --exclude option with a pattern:

rsync -av --exclude '*.txt' /source/ /destination/

This pattern matches any file ending in .txt, regardless of its directory depth.

Creating Incremental Backups

An incremental backup copies only the files that have changed since the last backup. The most common command combines the archive flag -a (which preserves permissions, timestamps, and symbolic links) with the verbose flag -v for progress reporting:

rsync -av /source/ /backup/incremental/

Because -a includes the --checksum behavior implicitly, rsync will compare file sizes and modification times, transferring only newer or altered files.

Backup Types: Full, Differential, and Incremental

Backup strategies differ in how they store changes over time. Understanding each type helps you design a reliable disaster‑recovery plan.

Full Backup

A full backup copies every file in the selected dataset. It provides a complete snapshot but can be time‑consuming and storage‑intensive.

Differential (Level‑1) Backup

A differential backup captures all changes made since the last full backup. For example, if a full backup was taken on Monday, a differential backup on Thursday includes every file modified from Monday through Thursday.

This approach reduces backup time compared to a full backup while still requiring less storage than a series of incremental backups.

Incremental Backup

Incremental backups store only the changes since the previous backup (whether full or incremental). Over time, a chain of incremental backups can become long, making restoration slower because each incremental step must be applied in sequence.

Choosing between differential and incremental depends on your recovery‑time objectives (RTO) and storage constraints.

RAID 5: Balancing Performance and Redundancy

Redundant Array of Independent Disks (RAID) provides fault tolerance and performance improvements. RAID 5 distributes data and parity information across all drives, allowing the array to survive a single drive failure.

Minimum Disk Requirement

RAID 5 requires at least three disks. With three disks, the system can store two data blocks and one parity block per stripe. If one disk fails, the missing data can be reconstructed from the remaining disks and the parity information.

How Parity Works

Parity is calculated using the XOR operation. For a stripe containing blocks A, B, and parity P, the relationship is:

P = A XOR B

If disk B fails, the system can recover B by computing:

B = A XOR P

This method ensures data integrity without needing a dedicated spare disk.

Putting It All Together: A Practical Scenario

Imagine a small office that needs to share files, protect sensitive data, and maintain reliable backups. Below is a step‑by‑step guide that combines Samba configuration, rsync backup strategies, and RAID 5 storage.

1. Set Up Samba Shares

• Create a public share with guest ok = yes for marketing materials.
• Define a private share with valid users = alice, bob for confidential documents.
• Use security = user globally to enforce user‑level authentication.

2. Configure RAID 5

Install three (or more) identical hard drives and create a RAID 5 array using mdadm:

mdadm --create /dev/md0 --level=5 --raid-devices=3 /dev/sda /dev/sdb /dev/sdc

Format the array with a Linux filesystem (e.g., ext4) and mount it at /srv/samba. This provides both performance and redundancy for the shared data.

3. Schedule Incremental Backups with Rsync

Set up a cron job that runs nightly:

0 2 * * * rsync -av --exclude '*.txt' /srv/samba/ /mnt/backup/daily/

Every week, perform a full backup on Sunday:

0 3 * * 0 rsync -av /srv/samba/ /mnt/backup/weekly/

This combination gives you a full weekly snapshot and daily incremental copies, while excluding large text logs that are not needed for recovery.

4. Verify and Test Recovery

Regularly test restoration from both the full and incremental backups. Use the --dry-run flag to simulate restores without overwriting live data.

Best Practices and SEO Tips for Documentation

When publishing technical guides online, follow these SEO‑friendly practices to increase visibility:

• Use clear headings: Search engines prioritize <h2> and <h3> tags that contain relevant keywords such as "Samba", "rsync backup", and "RAID 5".
• Include descriptive meta descriptions: Summarize the article in 150‑160 characters, mentioning the main topics.
• Employ internal linking: Connect this guide to related articles on Linux networking, file permissions, and disaster recovery.
• Optimize code snippets: Wrap commands in <pre><code> blocks for readability and to improve snippet ranking.
• Use alt text for images: If you add diagrams of RAID layouts, describe them with keywords like "RAID 5 parity diagram".

By structuring content with semantic HTML and focusing on user intent, you help both readers and search engines understand the material quickly.