Are my Public/Private CIFS shares setup correctly?

[pcmofo]

I was running FreeNAS with CIFS for a general network share of media etc and AFP for private network shares and backups. Now I am moving to all CIFS shares and doing away with AFP. My shares appear to be working in my test setup, I'd like to know what you guys think.

I have one pool from a 6x 4tb RAIDz2 vdev. that I plan on expanding in the future with future 6-drive vdevs.
I want to store Media on a easily accessible CIFS share that any new user or device on the network can access.
I want each user to have their own private share for backups or personal media storage. (eg someone wont accidentally access my photo/video project files or delete them by mistake)

I have the following groups/users setup
User: UserA, Group: home
User: UserB, Group: home
User: freenas, Group: home

So I have set up my pool with the following datasets.
MainPool
MainPoolDataset
- SharedMedia (owner: nobody, group: home)
- UserA (owner: UserA, group:wheel)
- UserB (owner: UserB, group:wheel)

I then set up 3 CIFS shares and set the CIFS guest users to freenas user
- Media (allow guest access)
- UserA
- UserB

From there, on my Mac, I can use SMB to access the Media share logging in as either guest or UserA or UserB. When I log in it asks me what share I would like to access, Media, UserA, or UserB. If I choose one I am not permitted to access (wrong user or guest) then I can't connect! If I sign in as a specific user I can access both the shared Media and my private folder.

This solution appears to be working exactly how I want it to allowing both public and private shares on the LAN based on local user accounts. My question to you guys, is this the correct method for creating this type of local shares?

 

[pcmofo]

After further testing it appears that UserA cannot write to UserB's share but any registered user can view and copy any and all files on the other users shares... so it looks like I only have this partially configured correctly...

 

[anodos]

Post output of

• getfacl /mnt/MainPoolDataset/SharedMedia
• getfacl /mnt/MainPoolDataset/UserA
• getfacl /mnt/MainPoolDataset/UserB
• getent group

My guess is that you have neglected to remove the "everyone" ACE from your shares. Do you have a windows computer to use to configure your shares?

 

[pcmofo]

Post output of

• getfacl /mnt/MainPoolDataset/SharedMedia
• getfacl /mnt/MainPoolDataset/UserA
• getfacl /mnt/MainPoolDataset/UserB
• getent group

My guess is that you have neglected to remove the "everyone" ACE from your shares. Do you have a windows computer to use to configure your shares?

Here is the output from those commands

SharedMedia
getfacl /mnt/testvol/datatest
# file: /mnt/testvol/datatest
# owner: nobody
# group: home
owner@:rwxpDdaARWcCos:fd----:allow
group@:rwxpDdaARWcCos:fd----:allow
everyone@:r-x---a-R-c---:fd----:allow

User A
getfacl /mnt/testvol/privatedatatest
# file: /mnt/testvol/privatedatatest
# owner: brett
# group: wheel
owner@:rwxpDdaARWcCos:fd----:allow
group@:rwxpDdaARWcCos:fd----:allow
everyone@:r-x---a-R-c---:fd----:allow

User B
getfacl /mnt/testvol/Private2
# file: /mnt/testvol/Private2
# owner: maryana
# group: wheel
owner@:rwxpDdaARWcCos:fd----:allow
group@:rwxpDdaARWcCos:fd----:allow
everyone@:r-x---a-R-c---:fd----:allow


getent group
wheel:*:0
daemon:*:1
kmem:*:2
sys:*:3
tty:*:4
operator:*:5:uucp
mail:*:6
bin:*:7
news:*:8
man:*:9
games:*:13
ftp:*:14
staff:*:20
sshd:*:22
smmsp:*:25
mailnull:*:26
guest:*:31
bind:*:53
proxy:*:62
authpf:*:63
_pflogd:*:64
_dhcp:*:65
uucp:*:66
dialer:*:68
network:*:69
audit:*:77
www:*:80
nogroup:*:65533
nobody:*:65534
avahi:*:200
messagebus:*:201
hast:*:845
ladvd:*:78
webdav:*:666
home:*:1001

 

[anodos]

Remove the "everyone" ACEs using the security tab in windows explorer on a windows computer, then check the "only allow guest access" box for your "media share".

Alternatively, set the following auxiliary parameters for your shares.
[User A]
valid users = brett

[User B]
valid users = maryana

then restart the CIFS service.

 

[pcmofo]

Remove the "everyone" ACEs using the security tab in windows explorer on a windows computer, then check the "only allow guest access" box for your "media share".

Alternatively, set the following auxiliary parameters for your shares.
[User A]
valid users = brett

[User B]
valid users = maryana

then restart the CIFS service.

That did the trick!
Specifically, I added the valid users to the auxiliary parameters for each of the 2 private shares respectively. (since I don't have a windows box up and running atm) I am able to log in and access the shared Media share and the correct private user share and I can't even connect to any other private shares let alone view their contents.

Thanks for the help with this anodos!